Verificador de Contraseñas Filtradas

Password to check

Only a 5-character fragment of this password's hash ever leaves your browser — never the password itself.

Enter a password to check it against known data breaches.

How to check if a password has been breached

Type a password to see whether it has turned up in a known data breach, without ever sending the password itself anywhere.

How the check stays private

The password is hashed with SHA-1 right here in your browser. Only the first 5 characters of that hash are sent to our server, which forwards just that fragment to Have I Been Pwned's free Pwned Passwords API and gets back every suffix HIBP has recorded for that fragment — typically several hundred of them.

The comparison against your password's exact hash happens back in your browser, against that list. Neither our server nor HIBP ever sees the full hash, let alone the password — this is the same k-anonymity model HIBP documents for exactly this reason.

What a result means

A breach count is how many times that exact password has been seen across every dataset HIBP indexes, not how many times *your* account specifically was compromised. A password can be widely breached without your account being one of the exposed ones, because the same weak or reused password shows up under many different accounts.

A clean result only means this specific password is not in HIBP's current index. It is not a general safety guarantee, and it says nothing about whether an account using it was breached through some other route.

If a password comes back breached

Stop using it anywhere, starting with the most sensitive accounts.
Change it on every account that still uses it — reused passwords are what make a single breach costly.
Use the Password Generator to create a new, unique password for each account, and store them in a password manager instead of memorizing them.

What actually leaves your browser

Only a 5-character hash prefix — never the password, and never the full hash. See the "How the check stays private" section above for the exact mechanism.

Preguntas frecuentes

Does ProntoUso ever see my password?

No. The password never leaves your browser in any form — only a 5-character fragment of its SHA-1 hash is sent, and even that fragment is not enough to reconstruct the password.

Why SHA-1? Isn't it broken?

SHA-1 is used here only because it's the specific format Have I Been Pwned's Pwned Passwords API expects for this lookup. It is not being used as a security mechanism to protect the password — it is a lookup key into a public breach index.

Is a breach count the number of times my account was hacked?

No. It's how many times that exact password string has been seen across every breach HIBP has indexed, regardless of whose account it belonged to.

What data source is this checking against?

Have I Been Pwned's Pwned Passwords service, a free, keyless, widely used index of passwords exposed in known data breaches.

Herramientas relacionadas

Disponible