Find out if your password has leaked, without sending it anywhere

Have I Been Pwned ↗ is a free service run by security researcher Troy Hunt. Its Pwned Passwords list holds passwords from real data breaches.

Your computer turns your password into a fingerprint (a SHA-1 hash, 40 letters and numbers). It sends only the first 5 characters of that fingerprint. The service replies with every leaked fingerprint that starts the same way, about 2,000 of them, and your computer checks the list itself. The service never learns which one was yours.

Windowsopen PowerShell (Windows key, type PowerShell, Enter). Copy this whole block, paste it in and press Enter:

$secure = Read-Host "Password to check" -AsSecureString
$plain  = [Runtime.InteropServices.Marshal]::PtrToStringBSTR([Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure))
$bytes  = [Text.Encoding]::UTF8.GetBytes($plain)
$hash   = -join ([Security.Cryptography.SHA1]::Create().ComputeHash($bytes) | ForEach-Object { $_.ToString("X2") })
$prefix = $hash.Substring(0,5); $suffix = $hash.Substring(5)
$lines  = (Invoke-RestMethod "https://api.pwnedpasswords.com/range/$prefix") -split "`r?`n"
$match  = $lines | Where-Object { $_.StartsWith($suffix) }
Write-Host "Sent to the internet: $prefix (first 5 of 40 characters)"
if ($match) { Write-Host ("LEAKED: seen {0:N0} times in data breaches." -f [int]($match -split ':')[1]) -ForegroundColor Red }
else { Write-Host "Not found in any known breach." -ForegroundColor Green }

Mac or Linuxopen Terminal, type bash and press Enter (Macs use a different shell by default, and this script is written for bash), then paste this and press Enter:

read -rs -p "Password to check: " pw; echo
if command -v sha1sum >/dev/null; then h=$(printf '%s' "$pw" | sha1sum); else h=$(printf '%s' "$pw" | shasum -a 1); fi
unset pw; h=$(echo "${h%% *}" | tr 'a-f' 'A-F'); p=${h:0:5}; s=${h:5}
echo "Sent to the internet: $p (first 5 of 40 characters)"
n=$(curl -s "https://api.pwnedpasswords.com/range/$p" | tr -d '\r' | grep "^$s:" | cut -d: -f2)
if [ -n "$n" ]; then echo "LEAKED: seen $n times in data breaches."; else echo "Not found in any known breach."; fi

It asks for a password and hides what you type. Here's the real output for password123, then Liverpool1, then glass-otter-violin-sunset-42, one run each:

Sent to the internet: CBFDA (first 5 of 40 characters)
LEAKED: seen 2,266,543 times in data breaches.

Sent to the internet: 2DB7A (first 5 of 40 characters)
LEAKED: seen 268,743 times in data breaches.

Sent to the internet: E237B (first 5 of 40 characters)
Not found in any known breach.

Each check takes a fraction of a second. Notice what was sent: just 5 characters each time. A football team plus a number feels personal, but more than a quarter of a million people had the same idea. (The Mac and Linux version prints the count without commas, so 2266543. Same number.)

On haveibeenpwned.com ↗, type your email address. It lists every known breach your address appears in, and what leaked (passwords, phone numbers, addresses).

You can also sign up there for a free alert if your email turns up in a future breach.