Free tool · Leaked password check
Has this password been leaked?
Criminals try leaked passwords on every account they can find. Check whether a password appears in a known data breach, without it ever leaving your device.
Your password is never sent anywhere. Your browser scrambles it, and only the first 5 characters of the scrambled version are used to look it up. Nothing you type is stored.
How we check without seeing your password
Your browser turns the password into a long code called a hash. The password itself never leaves your screen.
Only the first 5 characters of the hash are sent to Have I Been Pwned, which returns hundreds of possible matches.
Your browser compares the matches itself. Nobody else can tell which password you checked, or whether it was found.
Check your email addresses too
Have I Been Pwned shows which data breaches an email address has appeared in.
- Go to haveibeenpwned.com and enter each work email address.
- For any breach listed, change that account's password and switch on two-step verification.
- If you own your business domain, its free domain search can check every address at once. You prove you own the domain first.
What Cyber Essentials expects
Passwords need protection from guessing, such as two-step verification, a minimum length or a limit on attempts. Using a password manager and a different password for every account is the simplest way to meet this.
Read our guide to turning on two-step verification.
Password data from Pwned Passwords by Have I Been Pwned, licensed under CC BY 4.0. A password not being found doesn't make it strong: it only means it isn't in the breaches Have I Been Pwned has collected.
Passwords are one gap. What about the rest?
The free health check covers logins, updates, firewalls and more, based on the government-backed Cyber Essentials standard.