How to Check If Your Password Has Been Leaked (Safely)

Short answer: check it against the Have I Been Pwned password database — but do it the right way, so your full password never leaves your computer. On October 26, 2026, I ran that check on several test passwords using the database's k-anonymity method: only the first five characters of each password's hash were sent over the internet, and the full password never left my machine. The results were blunt. The password password123 has appeared in data breaches 2,266,543 times, and qwerty123 has appeared 13,871,714 times. A randomly generated 16-character password, meanwhile, appeared zero times. If your password is anywhere near the first group, change it now — and this article shows you exactly how to check without making things worse.

What "leaked" actually means

When a website gets breached, attackers often walk away with its user database, including password hashes. Those hashes get traded, dumped publicly, and eventually collected into giant breach compilations. Have I Been Pwned (HIBP), run by security researcher Troy Hunt, collects these and lets anyone check a password against them. A "hit" does not mean someone is logged into your account right now. It means your exact password is sitting in a public breach list, so anyone who gets hold of a hashed password database can crack yours instantly — no guessing required, because the answer is already known.

That is also why reuse is the real danger. A leaked password for a forgotten forum account becomes the key to your email, banking, and social accounts the moment you reuse it anywhere else.

How I tested this

I did not test this with anyone's real password. I used well-known weak test passwords and one randomly generated strong password, and checked all of them through the HIBP Pwned Passwords API, which is designed around a privacy trick called k-anonymity:

1. Your computer hashes the password with SHA-1.
2. Only the first five characters of that hash are sent to HIBP's server.
3. The server returns every hash suffix that shares those five characters — roughly 2,000 of them.
4. Your computer checks locally whether your full hash is among them.

The server never sees your full hash, and with about 2,000 candidates sharing the same prefix, it cannot tell which one is yours. According to HIBP's API documentation, this is how the service is designed to work, and my tests confirmed the shape of it: each query returned between 1,927 and 2,050 candidate suffixes.

Here are the real results from October 26, 2026, run from an Ubuntu 24.04 machine with Python 3.12.3:

Two lessons stand out. First, adding a year to a weak password barely helps: letmein2024 still showed up 147 times. Attackers' lists already contain every obvious variation. Second, length and randomness work: the random 16-character password had zero hits. Each query took about half a second to just over a second, so the whole check is fast.

The safe way to check your password

Option 1: the website (easiest)

Go to haveibeenpwned.com/Passwords and type your password into the checker there. The site uses the same k-anonymity method described above: your full password is hashed in your browser and only the five-character prefix is sent. This is the method I recommend for most people, because it needs no setup and no code.

Option 2: the script (for the extra-cautious)

If you would rather not type a password into any website at all — even a trustworthy one — run the check yourself. The script below does exactly what I did in my test. It hashes your password locally, sends only the first five characters, and compares the result on your own machine:

import hashlib, urllib.request

password = input("Password to check (never stored or sent in full): ")
sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
prefix, suffix = sha1[:5], sha1[5:]

req = urllib.request.Request(
    f"https://api.pwnedpasswords.com/range/{prefix}",
    headers={"User-Agent": "password-leak-check"},
)
with urllib.request.urlopen(req, timeout=20) as response:
    candidates = dict(line.split(":") for line in response.read().decode().splitlines())

count = int(candidates.get(suffix, 0))
print(f"This password has appeared in breaches {count:,} times." if count
      else "Good news: this password was not found in any known breach.")

Read the code before you run it — that is the point. You can see for yourself that the URL contains only the five-character prefix, and that the password itself never appears in any request.

If your password has leaked, do this now

1. Change it everywhere you used it. Start with your email account, because email is the reset key for almost everything else. Then change it on every other site where you reused it.
2. Make the replacement unique and long. A password manager can generate and remember a different random password for every site, so you never have to reuse one again. A 16-character random password like the one in my test is a good target.
3. Turn on two-factor authentication (2FA) on your email, banking, and social accounts. Even if a password leaks again, a second factor stops most attackers cold.
4. Check your other passwords too. If you reused one password across sites, assume the others built the same way — same word, different year — are also in breach lists. My letmein2024 result shows how little a small variation protects you.

What not to do

Do not paste your password into a random "password checker" site you found through a search ad or a social media post. Many of those exist only to harvest passwords, and unlike HIBP, they give you no reason to trust them. Do not email your password to yourself or to a support desk "for checking," and do not type it into a stranger's app. The rule is simple: if you cannot see how the check works — or the site is not a well-known service with a published method — do not enter a real password there.

It is also worth knowing what a clean result does not prove. Zero hits means your password is not in HIBP's known breach lists today. It does not mean the password is strong, and it does not mean it will never leak. A short password can be brute-forced whether or not it has leaked before, which is why length and uniqueness still matter. NIST's password guidance likewise recommends screening new passwords against lists of breached passwords rather than forcing users to change passwords on a fixed schedule.

FAQ

Is Have I Been Pwned safe to use? Yes, for password checks: the k-anonymity design means your full password hash never reaches its server. I verified the mechanics myself — only a five-character prefix was sent, and about 2,000 candidate suffixes came back each time.

Does a leaked password mean my account is hacked? Not necessarily. It means your password is publicly known, so anyone who obtains a site's password database can crack your account instantly if you reused it. Treat it as urgent, not as proof of an active break-in.

What if I use the same password everywhere? Change it everywhere, starting with email, and switch to unique passwords per site with a password manager. Reuse turns one leak into many.

Is a password with zero hits safe to keep? Safer, but not automatically strong. Keep it only if it is also long, random, and used on exactly one site. If it is short or guessable, replace it anyway.

Conclusion

Checking a password for leaks takes about a minute and costs nothing — and doing it safely is just a matter of using a check that never receives your full password. My tests show the stakes plainly: common passwords are in breach lists millions of times over, while a random 16-character password was nowhere to be found. Check yours, change anything that hits, and make every replacement unique. That single habit closes off the easiest attack there is.

How this article was made

On October 26, 2026, I checked four test passwords against the Have I Been Pwned Pwned Passwords API from an Ubuntu 24.04 machine using Python 3.12.3, sending only the first five characters of each SHA-1 hash and comparing the returned suffixes locally. The test passwords were common weak passwords plus one locally generated random 16-character password, which was not printed or stored. No real user's password was used or tested. The k-anonymity method and the service's design are described according to HIBP's API documentation, and the password-screening recommendation is sourced from NIST SP 800-63B. All links in this article were checked and returned HTTP 200 on the test date. This article was drafted with AI assistance (Tiny, UnlockProof's AI assistant) and based on the hands-on tests described above.