What comes back
One number: how many times that exact password appears across the public breach corpus. Anything above zero means it is on the lists that credential-stuffing tools read from, and how strong it looks is beside the point.
A password with millions of hits is being tried against every login form on the internet, continuously. A password with three hits is on a list somebody could still work through by hand.
How the password stays private
This matters more than the result, so here is the whole mechanism.
- Your browser hashes the password with SHA-1. The hash is computed on your device; the password does not go anywhere.
- The first five characters of that hash are sent to the Have I Been Pwned range API. Five characters, out of forty.
- That prefix is shared by hundreds of different passwords, so the service returns every hash it holds beginning with those five characters without knowing which one you asked about.
- Your browser looks for your full hash in the list it got back.
This is k-anonymity, and it is the reason the check can be honest about privacy. The request also carries a padding header, so the size of the response reveals nothing either.
We never see the password, the hash, or the answer. There is no request to our servers in this flow at all.
What to do if it is found
- Change it wherever you used it, starting with email and banking. An email account is the reset path for everything else, so it goes first.
- Do not change it to a variation. Adding a digit to a breached password is a move the tools already try.
- Turn on two-factor authentication where it is offered. It is what keeps a stolen password from being enough on its own.
- Run an email lookup on the address you use for those accounts to see which breaches you were actually in.
What it will not tell you
- Which account the password belongs to. The corpus is a list of passwords, not a list of logins.
- That a password not in the list is safe. It means this password has not appeared in a public breach yet. A short or guessable password that nobody has leaked is still a short, guessable password.
Common questions
Is it safe to type my real password in here?
The mechanism above is why we can say yes: it is hashed on your device and only a five-character prefix of that hash is transmitted. If you would rather not, the check works just as well on a password you are considering using.
Why SHA-1, which is a broken hash?
Because it is what the breach corpus is indexed by, and this is a lookup rather than a way of storing anything. The weakness in SHA-1 is collisions, which do not help anybody here.
Do you keep a record of what I checked?
There is nothing to keep. Password checks never reach our servers and are never written to your history.