Checking password exposure without sharing a password unnecessarily

A site that asks for your password to "check" it can see what you type. It might store it, log it, pass it to someone else or simply be badly secured, and you cannot tell from the page. A real password you have typed into the wrong place should be treated as exposed.

A well-designed check avoids this by never receiving the password at all. The design is called k-anonymity, and Have I Been Pwned (HIBP), a free breach-lookup service, uses it for its Pwned Passwords service.

1. Your browser turns the password into a SHA-1 hash, a fixed-length fingerprint, on your own device.
2. It sends only the first five characters of that hash to the Pwned Passwords range service. The password and the full hash are never sent.
3. The service replies with the ends (suffixes) of every known hash that starts with those five characters, each with a count of how many times it appeared in breached data. HIBP says a typical reply contains about 800 suffixes.
4. Your browser compares the rest of your hash with that list itself. The service never learns whether there was a match.

Because many different passwords share the same first five characters, the service cannot tell which one you were checking. HIBP also documents an option that pads each reply to between 800 and 1,000 entries, so that someone watching encrypted traffic cannot infer from the size of the reply which prefix you asked for. The padding entries have a count of zero and are ignored. HIBP says the range service needs no API key and you can inspect the requests in your browser's developer tools to see what is sent.

• Found: the password appears in known breached data, with a count of how often. HIBP says a password that has been breached should not be used, and that if you have used it anywhere you should change it. Changing it on one site is not enough if you reused it: change it everywhere you used it.
• Not found: HIBP's own wording is that this does not necessarily mean it is a good password, only that it is not in the data loaded into its service.

The check cannot tell you how strong a password is, which accounts it is used on, whether anyone has already used it against you, or whether it has appeared in a breach HIBP does not hold. It also cannot tell you whether your email address has been breached: that is a separate question, covered in What to do after your email appears in a data breach.

Checking is a way to catch a bad password. The National Cyber Security Centre (NCSC) recommends habits that make a bad password much less likely in the first place.

• Use three random words. The NCSC says a password made of three random words is strong enough for most purposes and easier to remember, so each account can have its own. Its example is "applenemobiro". Avoid common passwords, significant dates, family and pet names, and simple character swaps such as "o" for zero, which criminals know. Do not use that example: it is public.
• Use a password manager. It can generate and store a unique password for every account, and autofill only fills credentials on the right website, which helps protect against phishing. The NCSC says saving passwords in the browser or operating system on your own devices is acceptable, and that you should never save them on shared or public computers.
• Turn on 2-step verification (2SV). The NCSC says it keeps criminals out of your accounts even if they know your password. Start with email, then banking, social media and online shopping.
• Use a passkey where one is offered. The NCSC recommends passkeys as your first choice of sign-in where available; they are unlocked with your device's fingerprint, face check or passcode.