Has this password already leaked?
Checks a password against hundreds of millions already exposed in known data breaches. Your password is never sent anywhere, not even to us, only a partial, unreversible fingerprint of it leaves your browser.
A clean result here is a good sign, but it isn't a security review on its own. Weak or reused passwords, missing multi-factor authentication and misconfigured accounts all matter too.
Get in touchYour password never leaves your browser
The check works using a technique called k-anonymity. Your password is turned into a scrambled fingerprint (a hash) inside your browser, then only the first five characters of that fingerprint are sent to the breach database, never the password itself, and never the full fingerprint either.
The database sends back every fingerprint that starts with those five characters, often hundreds of them, and your browser checks locally whether the rest matches. There's no way to work backwards from any of this to your actual password.
A clean result isn't the whole picture
Not finding a password in this check means it hasn't shown up in a known breach yet, not that it's strong, or safe to reuse across other accounts. The single biggest improvement for most small businesses isn't a stronger password, it's turning on multi-factor authentication everywhere it's offered.
Want the full picture?
Tell me about your business and what's prompted the enquiry. I'll reply within one working day.