Why use passcheck
- HIBP k-anonymity. SHA-1 is computed in the browser; only a short hash prefix hits the API.
- Local entropy. Strength estimate from length and character classes — on your device.
- No password on our backend. We do not receive or store what you type.
- Clear results. Found / not found in breaches; when found, an approximate HIBP count.
- Honest limits. No absolute-security promise — HIBP corpus plus a heuristic only.
- Free and multilingual. No account; UI and SEO for every locale in the set.
- Pairs with a generator. Make a new password at passgen.dmosk.net.
How to check a password
- Enter a password (optionally show or hide the characters).
- Press Check: the browser hashes with SHA-1 and queries HIBP by hash prefix.
- Read breach status and the local strength estimate (bits, length, alphabet).
- If found, change it wherever it is still used; create a new one with passgen.
Password hygiene and HIBP
Have I Been Pwned collects password hashes from known breaches. A match means that string already appeared in leaked data — stop using it. Strength scoring is a heuristic, not a substitute for a unique random password.
Tips:
- Use a unique password for every service.
- Store passwords in a password manager, not notes or chat apps.
- Length and character variety beat dictionary “clever” words.
- Enable two-factor authentication wherever you can.
- If HIBP finds it, change the password everywhere it still works.
- “Not found” in HIBP does not mean “safe forever”.
- For a new password, use passgen.
- Do not type passwords on untrusted sites — this tool does not send yours to our server.
What passcheck is for
- quickly see if a password shows up in known breaches;
- get a rough entropy reading before you rotate credentials;
- explain why reused or weak passwords are risky;
- follow up with a generator on passgen;
- do it without uploading the password to our server.
FAQ
What is k-anonymity with HIBP?
The browser computes the password’s SHA-1 and sends only the first characters of the hash. HIBP returns suffixes for that prefix; the full match is checked locally — the full password never goes to the API.
Is the password uploaded to us?
No. We do not receive or store it. Only a short SHA-1 prefix goes to the HIBP API.
What is Have I Been Pwned?
Troy Hunt’s project that aggregates password hashes from public breaches. passcheck uses its range API so you can check without sending the full password.
What does the “seen N times” count mean?
An approximate number of times that string appears in HIBP data. Higher counts mean it has circulated more — change it.
What does the entropy estimate mean?
A rough heuristic: length × log2 of an estimated alphabet from character classes. Not a lab audit or a strength guarantee.
Does “not found” mean absolute safety?
No. HIBP is incomplete; a password can still be weak or leaked outside that corpus.
Where can I get a new password?
Open the generator at passgen.dmosk.net — creation stays in the browser.
Is the service free?
Yes — no sign-up and no fee for checks.
Does it work fully offline?
Strength estimate is local. Breach checks need network access to the HIBP API.
What if HIBP is down or CORS fails?
You will see a connection error. Try again later; the on-page strength estimate may still work.
Which hash algorithm is used?
SHA-1 of the password, as required by HIBP’s k-anonymity range API.
Do you keep a history of checks?
No. The typed password is not sent to us and is not stored in our database.