Has your password been pwned?

This is pure JavaScript so it all runs in the browser. You can view-source to verify. Your password never leaves your computer.

How it works (Have I Been Pwned k-anonymity, after “Has Your Password Been Pwned?” in 2600 Magazine Spring 2020 Vol.37 No.1 by Jan Markowski — HTML/JavaScript remake by Josh Pritt aka RAMGarden, Sept 23 2020):

  1. Hash your password locally with SHA-1 via crypto.subtle.
  2. Send only the first 5 hex chars to https://api.pwnedpasswords.com/range/XXXXX.
  3. That API returns suffixes (last 35 chars) + breach counts for that prefix.
  4. We check locally if your suffix appears. Full password and full hash are never sent.
    Privacy / debug details

    We never display your password or full hash. Only the 5-char prefix is sent. Last check:

    —

    ← back to PasswordChecker home

    Updated Oct 2025 version above. Original Sept 23, 2020 version preserved for history: testpass-2020.html

    Original article “Has Your Password Been Pwned?” by Jan Markowski in 2600 Magazine Spring 2020 Vol.37 No.1 — get your own copy: print edition · PDF edition · free code companion (testpass.sh)

    This page was modernized with OpenCode using OpenRouter.ai with Firebase Hosting, powered by Muse Spark 1.3 Free — Meta's model for agentic coding.