Check if your password has been exposed in data breaches
Uses k-Anonymity via Have I Been Pwned API. Your password is never sent over the network.The MailDrop password leak check tells you whether a password appears in known data breaches, without ever revealing the password itself. Type a password and the tool hashes it locally with SHA-1, sends only the first five characters of that hash to the Have I Been Pwned Pwned Passwords API, and compares the returned candidate list on your device. This k-anonymity design means neither our servers nor the API ever see your password or even its full hash.
Billions of passwords have been exposed in breaches over the years, and attackers feed those lists into automated credential-stuffing attacks against every major service. If a password you use appears in such a list, it is effectively public, no matter how strong it looks. Checking takes seconds and shows you a hard number: how many times that exact password has surfaced in breach data, from zero to millions.
The check is free, anonymous, and requires no registration. If a password comes back compromised, generate a replacement with our password generator, and consider pairing new accounts with a MailDrop temporary email address so a future breach of some minor site exposes as little about you as possible.
Type the password into the input field. Use the eye button to toggle visibility if you want to confirm you typed it correctly. Nothing is sent anywhere until you start the check.
Click Check Password. Your browser computes the SHA-1 hash of the password locally, keeps the hash to itself, and transmits only its first five characters to the Have I Been Pwned range API.
The API returns several hundred hash suffixes that share those five characters. Your browser scans that list locally for your full hash, so the service never learns which entry, if any, you were interested in.
A green result means the password is absent from known breach data. A red result shows how many times it has appeared; change it everywhere you use it, and switch to unique random passwords per site going forward.
Yes, because the password never leaves your browser. It is hashed locally, and only a five-character hash prefix, which matches hundreds of unrelated passwords, is sent to the API. Neither MailDrop nor Have I Been Pwned can reconstruct your password from that prefix. This k-anonymity model is the industry-standard way to do breach checks safely.
It means that exact password appears in publicly known breach dumps, and the count shows how many times. It does not necessarily mean your account was breached; someone else may have used the same password. Either way, attackers try these lists constantly, so you should stop using that password everywhere immediately.
Not by itself. Absence from breach data only means that password has not shown up in known leaks yet. A short or predictable password can still be cracked directly. Combine a clean breach result with real strength: length of 16 or more characters, generated randomly, and never reused across sites.
We cannot, even in principle: the password and its full hash exist only in your browser, and our servers are not involved in the check at all. The request goes directly from your browser to the Have I Been Pwned API carrying only the five-character hash prefix. There is nothing for anyone to store.
Change it on every account where you used it, starting with email and banking, and enable two-factor authentication where available. Use our password generator to create a unique random replacement per site, store them in a password manager, and use a MailDrop disposable email address for low-trust signups so future leaks carry less of your identity.