Has your password leaked?

🔒 The password never leaves your browser: the SHA-1 is computed here and only the first 5 characters of the hash are sent. The server returns every hash sharing that prefix and the final match is done locally (k-anonymity, via Have I Been Pwned).

⚠ This is mostly a demonstration of the protocol. In practice a good password manager already does this check for you — and generates long, unique passwords that never show up in breaches.