./prontouso.com

BẢO MẬT & RIÊNG TƯ

Kiểm Tra Rò Rỉ Mật Khẩu

Kiểm tra mật khẩu ẩn danh bằng mô hình k-Anonymity qua cơ sở dữ liệu Have I Been Pwned. Chỉ gửi 5 ký tự đầu của mã băm SHA-1, mật khẩu thực của bạn không bao giờ rời khỏi máy.

Trạng thái công cụSử dụng xử lý máy chủ
Xem trước

Only a 5-character fragment of this password's hash ever leaves your browser — never the password itself.

Enter a password to check it against known data breaches.

Cách thức hoạt động

  1. Nhập dữ liệu của bạn

    Điền các giá trị cần thiết, dán văn bản hoặc tải lên tệp bạn muốn xử lý.

  2. Xem kết quả tức thì

    Hầu hết các công cụ cập nhật theo thời gian thực khi bạn nhập liệu; một số công cụ sử dụng một nút hành động duy nhất.

  3. Sử dụng kết quả

    Sao chép, tải xuống hoặc chia sẻ kết quả được tạo — bạn luôn có toàn quyền kiểm soát dữ liệu của mình.

What actually leaves your browser — Your browser hashes the password locally and sends only a 5-character SHA-1 hash prefix to a ProntoUso server. The server forwards that prefix to Have I Been Pwned to retrieve possible matches; the exact comparison happens back in your browser. The password, full hash, prefix, and lookup response are not stored by ProntoUso.

Kiểm Tra Rò Rỉ Mật Khẩu là gì?

Type a password to see whether it has turned up in a known data breach, without ever sending the password itself anywhere.

TÌM HIỂU CÁCH HOẠT ĐỘNG CỦA CÔNG CỤ

How to check if a password has been breached

How the check stays private

The password is hashed with SHA-1 right here in your browser. Only the first 5 characters of that hash are sent to our server, which forwards just that fragment to Have I Been Pwned's free Pwned Passwords API and gets back every suffix HIBP has recorded for that fragment — typically several hundred of them.

The comparison against your password's exact hash happens back in your browser, against that list. Neither our server nor HIBP ever sees the full hash, let alone the password — this is the same k-anonymity model HIBP documents for exactly this reason.

What a result means

A breach count is how many times that exact password has been seen across every dataset HIBP indexes, not how many times *your* account specifically was compromised. A password can be widely breached without your account being one of the exposed ones, because the same weak or reused password shows up under many different accounts.

A clean result only means this specific password is not in HIBP's current index. It is not a general safety guarantee, and it says nothing about whether an account using it was breached through some other route.

If a password comes back breached

  • Stop using it anywhere, starting with the most sensitive accounts.
  • Change it on every account that still uses it — reused passwords are what make a single breach costly.
  • Use the Password Generator to create a new, unique password for each account, and store them in a password manager instead of memorizing them.

What actually leaves your browser

Your browser hashes the password locally and sends only a 5-character SHA-1 hash prefix to a ProntoUso server. The server forwards that prefix to Have I Been Pwned to retrieve possible matches; the exact comparison happens back in your browser. The password, full hash, prefix, and lookup response are not stored by ProntoUso.

Các Câu Hỏi Thường Gặp (FAQ)

Does ProntoUso ever see my password?

No. The password never leaves your browser in any form — only a 5-character fragment of its SHA-1 hash is sent, and even that fragment is not enough to reconstruct the password.

Why SHA-1? Isn't it broken?

SHA-1 is used here only because it's the specific format Have I Been Pwned's Pwned Passwords API expects for this lookup. It is not being used as a security mechanism to protect the password — it is a lookup key into a public breach index.

Is a breach count the number of times my account was hacked?

No. It's how many times that exact password string has been seen across every breach HIBP has indexed, regardless of whose account it belonged to.

What data source is this checking against?

Have I Been Pwned's Pwned Passwords service, a free, keyless, widely used index of passwords exposed in known data breaches.

Công Cụ Liên Quan