SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← Security & privacyES

Tool 1.11

Has my password been leaked? Pwned password check

Check if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.

Online checkOnly the first 5 characters of the password's SHA-1 hash go to Have I Been Pwned. The password never leaves your device.

An automated check; it doesn't guarantee security.

How to use it

  1. Type the password you want to check (use Show to see it).
  2. Press Check. Your browser hashes it and sends only the first 5 characters of the hash to Have I Been Pwned.
  3. If it was found, stop using it and change it everywhere you use it.

When it's worth checking a password

Check a password when a service you use announces a data breach, or when you use it on more than one site: criminals take email and password pairs leaked from one site and try them on email, banking and social media. It's also worth checking an old favorite that someone in the family insists is fine, like Colombia2024.

The check is about the password itself, not about you: it tells you whether that exact string appears in leaked password lists, whoever used it.

What `5BAA6` and the count mean

Type a password and press Check. Your browser turns it into a SHA-1 hash, a 40-character fingerprint. For the word password, that fingerprint starts with 5BAA6, and those 5 characters are all that leaves your device. Have I Been Pwned answers with every leaked fingerprint that starts the same way, mixed with fake entries so the size of the answer gives nothing away, and your browser looks for its own among them.

If the result says the password appears, say, 1,200 times, that string turned up 1,200 times across the breaches the service has collected. The count only tells you how popular it is. One appearance is enough to stop using it, because leaked lists are the first thing attackers try. A green result only means it isn't in those lists.

Why `Clave2024` doesn't fix a leaked `Clave2023`

A common mistake is changing Clave2023 to Clave2024, or adding an exclamation mark. Small variations of a leaked password are among the first guesses attackers make. Replace it with something new and unrelated, ideally from a password generator, and store it in a password manager.

A clean result doesn't mean your accounts are safe either: the password may be new to the lists and still weak, or someone may have seen you type it. And changing the password on one site doesn't protect the others where you reused it. Start with your email, because it can reset everything else.

FAQ

Is it safe to type my real password here?

The password itself isn't sent, only the 5-character prefix of its hash, as in the example above. Have I Been Pwned (at `api.pwnedpasswords.com`) sees that prefix and your IP address, as with any web request. Hundreds of leaked hashes share the same prefix, so the service can't tell which one you checked.

My password was not found. Is it strong?

Not necessarily. It only means it is not in the breach lists Have I Been Pwned knows about. A short or predictable password can still be guessed quickly, so use a long random password or passphrase.

Where does the breach data come from?

From Pwned Passwords, part of Have I Been Pwned: a public collection of real passwords exposed in data breaches, updated as new breaches come to light. A password that leaked in a breach nobody has published yet won't be there.

Does it tell me if my email was in a breach?

No. This page only checks passwords, and it never asks for your email. To see which breaches include your email address, use the search on Have I Been Pwned's own website.

Why is my password on the list if none of my accounts was hacked?

Because the list doesn't say whose password it was. Someone else may have chosen the same one, especially if it's short or common. Either way, attackers have it in their guessing lists, so treat it as used up.

Guides for this tool

  • 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
  • 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
  • 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
  • 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
  • 1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
  • 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
  • 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
  • 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
  • 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
  • 1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
  • 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
  • 1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
  • 1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌