How can a password be checked without sending it?
This matters more than the result, so here is the whole mechanism.
The method is documented by Have I Been Pwned and you can verify it yourself.
Your browser hashes the password with SHA-1, on your device. The first five characters of that forty-character hash are sent to the Have I Been Pwned range API. Five characters, out of forty. That prefix is shared by hundreds of different passwords, so the service returns every hash it holds beginning with those five characters.
Your browser then looks through that list for the rest of your hash. The comparison happens on your machine. The service never sees your password, never sees the full hash, and cannot tell which of the hundreds of returned entries you were asking about.
This is called k-anonymity, and it is why the check is safe to run on a password you are still using.
What does the result actually mean?
One number: how many times that exact password appears across the public breach corpus.
Anything above zero puts it on the lists that credential-stuffing tools read from. A password with millions of hits reaches every login form on the internet, continuously, driven by automated tools that cost nothing to run. A password with three hits is on a list somebody could still work through by hand.
Zero means it has not appeared in the corpus. That is good news and it is not a guarantee: the corpus covers known, public breaches, and a breach that has not been disclosed or not been published is not in it. Zero means not yet known, rather than definitively safe. It is also specific to that exact string: a one-character variant is a different password and gets a different answer.
Does password strength still matter after a leak?
No, and this is the part people find hardest to accept. Strength is a defence against guessing. Once a password is on a public list, nobody has to guess it.
A long password with symbols and mixed case might take centuries to brute-force. If it appears in a dump, an attacker reads it from a file in microseconds, and every measure of its strength becomes irrelevant. The strongest password in the world, once leaked, is exactly as weak as 123456.
That is why a strength meter and a breach check answer different questions. The meter says how hard this would be to guess. The check says whether anybody needs to.
Reuse is what turns one breach into many. Credential stuffing works by taking an email and password from one breached site and trying the pair everywhere else. A leaked password only costs you one account if you used it exactly once.
Once a password is on a public list nobody has to guess it, and every measure of its strength stops mattering.
What should you do if your password has leaked?
- Change it everywhere you used it, starting with email and banking. Email first, because whoever controls the mailbox can reset everything else.
- Do not modify it. Adding a digit to a leaked password produces a variant that stuffing tools already try, because everybody does exactly that.
- Turn on two-factor authentication wherever a service offers it. It stops a known password from being enough on its own.
- Use a password manager so that the next breach costs you one account rather than all of them.
The order matters. Changing a dozen passwords while the mailbox that can reset them is still compromised achieves nothing, because the attacker simply resets them again. Secure the account that controls the others first, then work outwards.
Is it safe to type a password into a checking tool?
It depends entirely on how the tool is built, and it is a fair thing to be suspicious of. A site that posts your password to its server has just been handed a working credential, and you cannot see what it does next.
The range-API method above is the reason a check can be trustworthy: the password does not leave your device, so there is nothing for the service to keep. You can verify this yourself by opening the network tab of your browser's developer tools and watching the request — five characters go out, a long list comes back.
If a checking tool will not tell you which method it uses, assume the answer is the bad one and close the tab.
How do you stop this being a problem at all?
Start on the password check page, which is free. Then make every password unique, so no breach can reach more than the one account it came from. That is impossible to do by memory and trivial with a password manager, which is why the manager is the actual answer rather than any rule about symbols and capitals.
Add two-factor authentication on the accounts that can reset the others: email first, then banking, then anything holding payment details. An app-based code or a hardware key beats an SMS, which can be redirected by somebody who persuades a phone shop to move a number.
Then run this check occasionally on the passwords you have kept on the password check page. It is free and does not spend a lookup, because a check that costs money is one people skip.
Common questions
How can I check if my password has been leaked?
Run it against the public breach corpus using a tool that hashes the password in your browser and sends only the first five characters of the hash. You get back a count of how many times that exact password appears in known breaches. Any number above zero means it is on public lists.
Is it safe to type my password into a breach checker?
It is safe when the tool uses the range-API method, where the password is hashed on your device and only five characters of the hash are transmitted. It is not safe when the tool posts your password to a server. If a checker does not say which method it uses, do not use it.
What is k-anonymity in a password check?
It is the technique that lets a service answer without learning the question. Your browser sends five characters of a forty-character hash, which hundreds of different passwords share. The service returns every hash with that prefix, and your browser finds the match locally, so the service cannot tell which one you asked about.
Does a strong password still matter if it has been leaked?
No. Strength protects against guessing, and nobody guesses a password that is already in a public file. Once it appears in a dump, an attacker reads it in microseconds, so a long password with symbols is exactly as compromised as a short obvious one. Change it rather than assess it.
What should I do if my password appears in a breach?
Change it everywhere you used it, starting with your email account, because whoever controls the mailbox can reset everything else. Do not just add a digit, since stuffing tools try those variants. Turn on two-factor authentication, and move to a password manager so the next breach costs one account.
Does zero results mean my password is safe?
It means the password has not appeared in the known, public breach corpus. Breaches that have not been disclosed, or that have not been published, are not in it. Zero is genuinely good news and should be read as not yet known rather than as a guarantee of safety.
Can this check tell me which site leaked my password?
No, and that is a consequence of how it protects you. The check compares a hash against a corpus of leaked passwords, which is not linked to accounts. To find which services exposed you, search your email address with the email lookup instead — a breach search by address does name the sites and the dates.
Is the password check free?
Yes. On DetectiveCheck the password exposure check costs nothing and does not spend a lookup credit, deliberately: a security check people are charged for is a security check people skip, and the whole value of this one comes from running it on every password you still use.
