# Pwned Password Check

URL: https://phishdestroy.io/developer-tools/pwned-password-check
Category: Personal security
Where it runs: Network: HIBP

Check a password against the Pwned Passwords list of Have I Been Pwned without sending it: your browser hashes it with SHA-1 and asks only for the 5-character prefix of that hash.

Only the first 5 characters of the password’s SHA-1 hash are sent to Have I Been Pwned (api.pwnedpasswords.com); the password itself never leaves the browser.

## Example input

A password from every breach list

```
password
```

Found more than 50 million times. The only data sent is the hash prefix 5BAA6; the full SHA-1 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8 is matched in the browser.

## FAQ

### What exactly is sent to Have I Been Pwned?

Only the first 5 hexadecimal characters of the password's SHA-1 hash, for example 5BAA6. The service answers with every hash suffix that starts with them, plus padding rows that hide the real size of the answer, and your browser looks for the rest of the hash in that list.

### Does not found mean the password is safe?

No. It only means the password is not in the breach corpus that Pwned Passwords holds; a short or predictable password can still be guessed quickly. A found result is reliable, because attackers try passwords from breach lists first.

### Can I check a hash instead of the password?

Yes. Choose Its SHA-1 hash and paste the 40-character hex hash; the same 5-character prefix is sent. The page does not store the password or the hash, and Clear empties the field and the result.

## Related tools

- [Password Generator](https://phishdestroy.io/developer-tools/password-generator)
- [Passphrase Generator (BIP39 Words)](https://phishdestroy.io/developer-tools/passphrase-generator)
- [TOTP Code Generator](https://phishdestroy.io/developer-tools/totp-hotp-generator)
- [AES-GCM Encrypt / Decrypt](https://phishdestroy.io/developer-tools/aes-gcm-encryption)
- [Text Hash Generator](https://phishdestroy.io/developer-tools/hash-generator)

All tools: https://phishdestroy.io/developer-tools