Your password never leaves this page — only 5 characters of its hash are sent.
Password leak check
Check whether a password appears in known breaches — the password never leaves your browser, only 5 characters of its hash.
the password is hashed with SHA-1 in your browser; only the first 5 hex characters of the hash are sent, and the match is decided locally (k-anonymity)
Data from Have I Been Pwned (Pwned Passwords), haveibeenpwned.com
How the check preserves the password
Your password is hashed with SHA-1 in this page, and only the first five characters of that hash are sent. The service returns every hash suffix sharing those five characters — several hundred of them — and the match is decided here, locally. This is k-anonymity: neither we nor Have I Been Pwned learn which password you asked about.
The count shown is how many times that exact password appears in known breach corpora — which is also how many times it appears in the lists attackers use.
So the password really never leaves the page?
Correct. What leaves is five hexadecimal characters of its hash, which match roughly one in a million hashes. You can confirm it in your browser's network tab: the request body contains a five-character prefix and nothing else.
My password was not found. Is it safe?
It means it is not in this corpus, which is not the same as strong. A password nobody has breached yet can still be guessed in seconds if it is short or predictable. Absence here is a floor, not a verdict.
It was found. What now?
Change it everywhere it was used, starting with anything sharing it. A breached password is already in the credential-stuffing lists, so the risk is not that someone will crack it — it is that they will simply try it.
Why SHA-1, which is broken?
SHA-1 is broken for collision resistance, which does not matter here — the hash is an index into a public dataset, not a security boundary. The dataset is published in SHA-1, so the lookup uses SHA-1.
Related tools: Password generator, bcrypt / htpasswd and JWT decoder.