Password Breach Check

Check if a password has appeared in known data breaches using k-anonymity. This is a client-side simulation demonstrating how Have I Been Pwned works.

Privacy Notice

This is a client-side demo. Your password never leaves your browser. All hashing and comparison is performed locally using the Web Crypto API.

Enter a Password to Check

Password Strength

Enter a password to see its strength analysis.

Breach Statistics

Total Breached Accounts

12,841,756,340

Unique Breached Passwords

847,223,402

Known Breach Sources

862

Paste Sources

126,073

* Statistics are simulated for demonstration purposes and represent approximate real-world figures from the Have I Been Pwned database.

Important Notes

●k-Anonymity ensures your full password hash is never sent to any server. Only the first 5 characters of the SHA-1 hash are transmitted.
●In a real implementation, the HIBP API returns ~500 hash suffixes for each prefix query, making it impossible for the server to determine which password you checked.
●This demo uses a local database of ~50 common breached passwords. The real HIBP database contains 847+ million unique passwords.
●Never enter your real passwords on untrusted websites. Use the official haveibeenpwned.com for actual breach checks.

Back to Playground