🔒 Your password is never sent, not even encrypted
🔑 Has my password leaked?
Find out whether a password appears among the hundreds of millions of passwords stolen in real data breaches, how long an attacker would take to guess it, and create a truly strong one.
How is this possible without sending the password?
Your browser computes the SHA-1 fingerprint of the password and sends only its first 5 characters to the public Have I Been Pwned service (the "k-anonymity" method). The service returns hundreds of fingerprints starting the same way, plus padding entries, and the comparison happens here, on your device. Neither the password nor its full fingerprint ever leaves your device.
🎲 Generate a strong password
Safe apps, tested before everyone else
Join the OUFRID club: early access, free Premium and your name in the app.
Join the clubBreach data: Have I Been Pwned's Pwned Passwords (Troy Hunt, CC BY 4.0 license). Strength estimate: zxcvbn-ts (MIT license).