Random passwords from letters, digits and symbols via crypto.getRandomValues.
Pwned Password Check
Network: HIBPNew
Use Pwned Password Check
What it does
Check a password against the Pwned Passwords list of Have I Been Pwned without sending it: your browser hashes it with SHA-1 and asks only for the 5-character prefix of that hash.
Only the first 5 characters of the password’s SHA-1 hash are sent to Have I Been Pwned (api.pwnedpasswords.com); the password itself never leaves the browser.
Example
A password from every breach list
passwordFound 52,372,427 times in the Pwned Passwords breach corpus. Do not use this password. Change it wherever you use it, give every account its own password (a password manager makes that practical) and turn on two-factor authentication.
SENT TO THE SERVICE
5BAA6 (5 of 40 characters)
SUFFIXES RETURNED
1,978 + 135 padding rows
MATCHED IN YOUR BROWSER
yesFound more than 50 million times. The only data sent is the hash prefix 5BAA6; the full SHA-1 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8 is matched in the browser.
FAQ
What exactly is sent to Have I Been Pwned?
Only the first 5 hexadecimal characters of the password's SHA-1 hash, for example 5BAA6. The service answers with every hash suffix that starts with them, plus padding rows that hide the real size of the answer, and your browser looks for the rest of the hash in that list.
Does not found mean the password is safe?
No. It only means the password is not in the breach corpus that Pwned Passwords holds; a short or predictable password can still be guessed quickly. A found result is reliable, because attackers try passwords from breach lists first.
Can I check a hash instead of the password?
Yes. Choose Its SHA-1 hash and paste the 40-character hex hash; the same 5-character prefix is sent. The page does not store the password or the hash, and Clear empties the field and the result.