iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use a checker that documents its privacy design, and do not paste your password into an unfamiliar site, search engine, chat, or email. Have I Been Pwned’s Pwned Passwords service hashes the password on your device, sends only the first five characters of that SHA-1 hash, and compares the returned candidates locally. Enter the complete password first and submit one check; do not request a result after every keystroke.
If the password is found, retire it everywhere it was used, starting with email and financial accounts. Replace it with a unique password, then enable multifactor authentication (MFA) or a passkey where available. A no-match is limited to that service’s loaded breach corpus: it does not prove the password is strong or that it has never appeared in another breach.
What a “leaked password” check can and cannot tell you
A password check answers a narrow question: does this exact password appear in the dataset the checker has loaded from known breaches? It does not prove that an account was taken over, identify which account exposed the password, measure password strength, or establish that the password is absent from every criminal database.
Free tools Windows power users keep installed
One-click scans. No signup required.
The distinction matters because attackers commonly reuse credentials found in one breach against unrelated services. A password that was exposed years ago can still put a current email, shopping, cloud, or financial account at risk if you reused it. Email deserves early attention because control of an inbox can affect password resets for other accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The scale of the underlying problem is substantial. NIST reported that the Identity Theft Resource Center recorded more than 3,000 data breaches in 2024. That is a count of breaches, not a count of password exposures, but it illustrates why a cautious checking method is useful.
NIST Digital Identity Program leader Ryan Galluzzo summarizes the basic rule plainly: “The worst password I can think of is ‘password’ or ‘12345.’” A breach lookup should support a broader security plan, not replace one.
Choose a checker by its privacy behavior
Before entering anything, determine exactly what the service sends, where matching occurs, and whether it warns against incremental queries. The safest practical choice is a recognized service with publicly documented behavior. Have I Been Pwned (HIBP) provides a concrete example through its Pwned Passwords design.
| Checking approach | Does the complete password leave your device? | What the service receives | Where the comparison occurs | Main concern |
|---|---|---|---|---|
| HIBP Pwned Passwords documented method | No, according to HIBP’s description | The first five characters of the password’s SHA-1 hash | On your device, after candidate suffixes are returned | A party observing requests can still see the prefix; repeated partial queries reveal more information |
| Unfamiliar “password checker” | Unknown | Unknown until its documentation is reviewed | Unknown | The operator could receive or retain the complete password |
| An established password manager feature | Depends on the manager’s documented implementation | Depends on the feature | Depends on the feature | Do not assume a privacy design without reading the provider’s explanation |
A hash-prefix design is a reduction in exposure, not a guarantee of zero disclosure. HIBP’s API documentation notes that an observer who can see inbound requests can see the prefixes. That is why the service advises waiting until the password is fully entered instead of checking after each character.
How to check a password with HIBP’s documented method
1. Select the official password-checking function
Use HIBP’s Pwned Passwords checker or another established password manager feature whose privacy behavior is clearly documented. Confirm that you are using the password-checking function, not an email-breach lookup. Do not use a page that asks you to create an account, upload a password list, or send a password by email or chat merely to obtain a result.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Because a checker receives at least some request data, treat the service choice as a security decision. A familiar logo or search ranking is not proof that a page is legitimate. Use the service’s official site or application entry point, verify the spelling of the domain yourself, and avoid links in unsolicited messages.
2. Prepare the password without exposing it elsewhere
Work on a device you trust. Do not copy the password into a public note, browser search box, online form, support ticket, or shared clipboard. If the password is currently used on an account, you can check it before changing it, but avoid doing so on a computer that may have keylogging or remote-control malware. If you suspect the device itself is compromised, use the affected service’s official recovery process from a clean device instead of treating a web lookup as an investigation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute3. Enter the complete password, then submit one request
Type or paste the password only into the checker’s password field. Wait until the complete value is present before starting the lookup. Do not trigger a request for every character, every paste event, or every edit. HIBP specifically warns that incremental requests could reveal more information to someone able to observe inbound traffic.
Submitting once also avoids creating a needless sequence of related hash prefixes. The privacy design reduces what any one request reveals; it does not make a long series of progressively changing requests equivalent to one completed check.
4. Understand what is sent and returned
In HIBP’s documented flow, the password is hashed locally with SHA-1. The service receives only the first five characters of that hash, not the complete password and not the full hash. It returns candidate hash suffixes associated with that prefix. Your device then compares the complete locally calculated hash with those returned suffixes and determines whether there is a match.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This arrangement means HIBP does not need the plaintext password to perform the lookup. It also means the request is not completely invisible: the five-character prefix is still transmitted, and a network observer could record it. The method is therefore safer than sending the password itself, while not being a promise that no information leaves the device.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches5. Interpret the result narrowly
- Match: the exact password appears in the corpus used by the checker. Stop using it, including on every other service where you reused it.
- No match: the password was not found in that checker’s loaded dataset. This is not a strength rating, a clean bill of health, or evidence that no other breach contains it.
- Unexpected result: check for typing or paste errors, then use the service’s documented support or recovery route. Do not submit the password repeatedly to random sites to obtain a second opinion.
What to do immediately after a match
Treat a match as a reason to retire the password, not as a reason to investigate how an attacker might use it. The password may be old, and the listed breach may not identify your account, but reuse makes the same string valuable to automated login attempts elsewhere.
- Change the password on the affected service. Use that service’s official account settings or recovery page. If you cannot sign in, follow its published recovery and compromise procedures rather than responding to an unsolicited “security” message.
- Change every reused instance. Search your password manager, account records, or memory for services that used the same password or a predictable variation. Include old accounts that still contain personal information or payment details.
- Prioritize high-impact accounts. Start with your primary email and financial accounts, then move to cloud storage, work systems, social networks, shopping accounts, and any service that can reset another account. Email is especially important because it can control recovery messages.
- Make every replacement unique. A password manager can generate and store a separate password for each service. HIBP recommends password managers for this purpose. Do not create a pattern such as one base word plus the site name; once one version is exposed, the pattern can help an attacker guess the rest.
- Turn on MFA. NIST lists authenticator applications, push notifications, text codes, and USB security devices among MFA options, while noting that their security differs. Use MFA on important accounts even after replacing the password.
- Prefer phishing-resistant MFA when offered. CISA recommends phishing-resistant MFA for services such as email and VPNs when defending against compromised credentials. A FIDO2 security key is one possible physical option, but compatibility depends on the service and device; no particular model is required for this response.
- Consider a passkey. NIST describes passkeys as distinct per login and resistant to common password-phishing and password-reuse problems. They are an option where the service supports them, not a requirement for every account.
- Use official recovery procedures if takeover signs exist. Unexpected password-reset messages, changed recovery details, unfamiliar login alerts, or an inability to sign in require the service’s own account-recovery and security process. A password-corpus match alone cannot tell you whether an attacker has already accessed the account.
Why a no-match is not proof of safety
HIBP’s result is bounded by the password records in its loaded corpus. A password can return no match because the relevant breach is not included, the exposure has not been incorporated, the password was altered before storage, or the exact value differs from the one in the dataset. The result also says nothing about whether the password is easy to guess, reused, short, or based on public information.
Continue with the safer baseline even after a no-match: use a distinct password for each service, store it in a reputable password manager with a documented security model, and enable MFA. A no-match can be reassuring about that particular corpus, but it should not change those practices.
NIST Special Publication 800-63B-4, dated July 2025, explains that an attacker can perform offline guessing after obtaining a database containing hashed passwords. How feasible that guessing is depends on how passwords were stored and the conditions of the attack. That is another reason not to treat a password’s absence from one lookup as permanent protection.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Password checks and email-breach checks are different
A password lookup tests a password value against a corpus. An email-address lookup tests whether an address appears in disclosed breach records. They answer different questions and neither result maps a particular password to a particular account.
- An email match can tell you that the address appeared in one or more breach records, but not which password was exposed or whether the password is still in use.
- A password match can tell you that the exact password appears in the checker’s corpus, but not which of your accounts used it or which breach supplied it.
- Using both checks can improve awareness, but neither substitutes for changing reused passwords and enabling MFA.
Common unsafe methods and better alternatives
Pasting the password into an unknown website
Risk: the operator may receive, log, or reuse the plaintext. A page that says “instant breach check” without explaining its data flow gives you no basis for trusting it.
Better approach: choose a recognized checker with a documented design, such as HIBP’s local-hash and five-character-prefix method, or use a password manager’s feature only after reviewing its documentation.
Searching the password on the web
Risk: search services, browser history, autocomplete, extensions, and network logs can record the value. Search engines are not password-checking tools.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Better approach: keep the password inside the documented checker field and submit one completed request.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Checking after every keystroke
Risk: the sequence of prefixes can expose more information to an observer than a single completed request. HIBP’s API guidance specifically cautions against incremental checking.
Better approach: enter the full password first, then perform one lookup.
Assuming a no-match means the password is strong
Risk: the dataset may not contain the relevant breach, and a password can be guessable without appearing in that corpus.
Recommended Free Tools
Better approach: use unique generated passwords, a password manager, and MFA regardless of the lookup result.
Changing only the account named in a breach notice
Risk: reused credentials can be tried against other services, including email and financial accounts.
Better approach: identify every reuse and replace each instance with a different password, starting with accounts that control recovery or money.
A practical decision checklist
- Does the checker explain whether the complete password leaves your device?
- Does it state what partial data is sent and whether matching occurs locally?
- Have you waited until the password is complete before submitting?
- Did the result come from a password-corpus check rather than an email-address lookup?
- If there was a match, have you changed every reused instance?
- Are replacement passwords unique and stored securely?
- Is MFA enabled on email, financial, work, and other high-impact accounts?
- Can the service use a passkey or phishing-resistant MFA?
- If you see signs of account takeover, are you using the service’s official recovery process from a trusted device?
What this method does not protect against
A privacy-preserving lookup does not clean an infected device, detect an attacker who already has a live session, recover a stolen account, or guarantee that the checker’s corpus is complete. It also cannot determine whether a breach came from a particular service without separate breach information.
Use the lookup as one controlled decision point: check the exact password through a documented mechanism, retire it when found, eliminate reuse, and strengthen the account with MFA or a passkey. Keep the password itself out of every other channel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
