What this tool checks
Have I Been Pwned maintains the largest public database of passwords exposed in real data breaches — over 900 million unique passwords at last count. This tool checks whether a password you're considering appears in that dataset, using the service's Pwned Passwords k-anonymity API: your browser hashes the password with SHA-1, sends only the first 5 characters of that hash, and matches the real result locally against the full list of suffixes the API returns.
Why a breached password is dangerous even on a different site
Attackers don't need to breach your account directly — they take the billions of email/password pairs leaked from other services and try them against every login page they can find (a technique called credential stuffing). A password that leaked from an unrelated forum in 2015 is still actively tried against banking and email logins today. If your password shows up here, the risk isn't theoretical: it's already in the wordlists.
What this tool doesn't check
A password with zero breach hits isn't necessarily a strong one — "not yet breached" and "hard to guess" are different properties. Use this alongside the password strength checker, which evaluates length, character variety, and predictable patterns independently of any breach data.