./prontouso.com

SECURITY

Password Breach Checker

Check a password against Have I Been Pwned's Pwned Passwords database using k-anonymity: only a 5-character hash fragment is ever sent, never the password or its full hash.

Tool statusUses server processing
Preview
prontouso://dev/breach-lab
K-ANONYMITYHIBP

Only a 5-character fragment of this password's hash ever leaves your browser — never the password itself.

Enter a password to check it against known data breaches.

Why this doesn't leak your passwordYour browser hashes the password locally, then sends only the first 5 characters of that hash. The server asks Have I Been Pwned for every breached password sharing that fragment, and the final match happens back in your browser — the full hash, and the password itself, never leave your device.
What a breach match meansA match means this exact password has appeared in at least one data breach HIBP has indexed — it says nothing about which site or account. Treat any match as compromised everywhere you've used it.
Two independent signalsStrength and breach status measure different things. A password can be long and random yet still show up in a breach if it was ever exposed, and a short common word is weak even if HIBP hasn't happened to index it yet.

How it works

  1. Enter your input

    Fill in the values, paste your text, or upload the file this tool works with.

  2. See results instantly

    Most tools update live as you type; a few use a single button. Either way, the result appears right on this page.

  3. Use your results

    Copy, download, or share what the tool produces — you're always in control of the output.

What actually leaves your browser — Your browser hashes the password locally and sends only a 5-character SHA-1 hash prefix to a ProntoUso server. The server forwards that prefix to Have I Been Pwned to retrieve possible matches; the exact comparison happens back in your browser. The strength estimate and crack-time calculation run entirely in the browser, with no server call at all. The password, full hash, prefix, and lookup response are not stored by ProntoUso.

What is Password Breach Checker?

Check whether a password has turned up in a known data breach without sending the password itself anywhere, and get a real strength estimate and crack-time calculation alongside it.

UNDERSTAND THE TOOL

How to check if a password has been breached

Type a password to see whether it has turned up in a known data breach, read its estimated strength and crack time, and decide what to do about it — without ever sending the password itself anywhere.

How the check stays private

The password is hashed with SHA-1 right here in your browser. Only the first 5 characters of that hash are sent to our server, which forwards just that fragment to Have I Been Pwned's free Pwned Passwords API and gets back every suffix HIBP has recorded for that fragment — typically several hundred of them.

The comparison against your password's exact hash happens back in your browser, against that list. Neither our server nor HIBP ever sees the full hash, let alone the password — this is the same k-anonymity model HIBP documents for exactly this reason.

What a result means

A breach count is how many times that exact password has been seen across every dataset HIBP indexes, not how many times *your* account specifically was compromised. A password can be widely breached without your account being one of the exposed ones, because the same weak or reused password shows up under many different accounts.

A clean result only means this specific password is not in HIBP's current index. It is not a general safety guarantee, and it says nothing about whether an account using it was breached through some other route.

Estimated strength and crack time

As you type, the tool calculates entropy bits locally — no server call involved — and converts that into an estimated offline-attack crack time. Unlike a meter that just counts which character types are present, it also checks whether the password is one of the world's most common ones, or contains an obvious sequence ("1234", "abcd") or a repeated run ("aaaa") — any of those drop the grade to "weak" no matter how many letters, numbers, and symbols the password mixes in.

Breach status and strength measure different things: a long, random password can still turn up breached if it was ever exposed somewhere, and a short common word is weak even if HIBP hasn't happened to index that exact one yet.

If a password comes back breached (or weak)

  • Stop using it anywhere, starting with the most sensitive accounts.
  • Change it on every account that still uses it — reused passwords are what make a single breach costly.
  • Use the "Generate a strong password" button that appears right in this tool once it spots a problem — it builds a random password locally in your browser, ready to copy.

What actually leaves your browser

Your browser hashes the password locally and sends only a 5-character SHA-1 hash prefix to a ProntoUso server. The server forwards that prefix to Have I Been Pwned to retrieve possible matches; the exact comparison happens back in your browser. The strength estimate and crack-time calculation run entirely in the browser, with no server call at all. The password, full hash, prefix, and lookup response are not stored by ProntoUso.

Frequently Asked Questions

Does ProntoUso ever see my password?

No. The password never leaves your browser in any form — only a 5-character fragment of its SHA-1 hash is sent, and even that fragment is not enough to reconstruct the password.

Why SHA-1? Isn't it broken?

SHA-1 is used here only because it's the specific format Have I Been Pwned's Pwned Passwords API expects for this lookup. It is not being used as a security mechanism to protect the password — it is a lookup key into a public breach index.

Is a breach count the number of times my account was hacked?

No. It's how many times that exact password string has been seen across every breach HIBP has indexed, regardless of whose account it belonged to.

How is the strength estimate calculated?

From the character types used and the length — with one important twist: if the password is one of the world's most common ones, or has an obvious sequence or repeated run, the grade drops to "weak" regardless of the entropy math, because those passwords are the first ones an attacker tries, no matter how many bits they appear to have.

What data source is this checking against?

Have I Been Pwned's Pwned Passwords service, a free, keyless, widely used index of passwords exposed in known data breaches.

Related Tools