Password Breach Checker

How the breach check works

When you press Check Now, your browser computes the SHA-1 hash of your password locally. Only the first five characters of that hash are sent to the Have I Been Pwned Pwned Passwords service. The service replies with every breached-password hash that starts with those five characters, typically several hundred, and your browser compares them against the rest of your hash.

This technique is called k-anonymity. Neither GenPass nor Have I Been Pwned ever receives your password or its full hash, so neither can know which password you checked.

What the result means

• “Pwned” with a count: this exact password appears in breach data that criminals use. Attackers try these passwords first, so stop using it everywhere and change it on every site where you used it.
• “No pwnage found”: the password isn't in the known breach corpus. That's good, but it doesn't make a weak password strong. Also check it with the strength checker.

Checking your email address

To see which breaches your email address was involved in, use the official search at haveibeenpwned.com. You can also subscribe there for alerts about future breaches. GenPass doesn't perform email lookups.

What to do if a password has been breached

1. Change it immediately on every account that uses it, starting with email and banking.
2. Use a unique password for each site from now on. A password manager makes this practical.
3. Turn on two-factor authentication for important accounts.
4. Review recent account activity and sign out unknown sessions or devices.
5. Watch out for phishing emails that reference the breach.

Frequently asked questions