d4 · tools · password exposure check
Find out whether a password has turned up in a known data breach, without ever sending it anywhere. Your password is hashed on your device and only the first five characters of that hash are used to fetch a batch of candidates; the comparison happens here, in your browser.
Five characters. Nothing else. The password is not sent to d4vinder.com, is not sent to Have I Been Pwned, and is not stored, logged or transmitted anywhere by this page. There is no form submission: the button is wired to run locally.
Type or paste the password. If you would rather not type a real password into any page at all, that instinct is a good one, and the SHA-1 tab below does the same job from a hash you compute yourself.
If you already have the SHA-1 of a password, from our hash tool or your own scripts, paste the full 40-character hex digest. The same k-anonymity lookup runs, and the password itself never enters this page.
The technique is simple enough to check for yourself, which is rather the point.
SHA-1 is used because that is what the breach corpus is indexed by. It is not being relied on for security here: it is an index key, and the safety of the lookup comes from the prefix split, not the hash.
A match means the password appears somewhere in a corpus of breached credentials. It does not mean one of your accounts was breached, and it says nothing about your email address or username. It does mean the password is in the lists attackers use for credential stuffing, so it should not be used anywhere, however complicated it looks.
No match means the password is not in that corpus. That is genuinely useful, but it is not a verdict on strength: a short or predictable password can be absent from every breach list and still fall to a guessing attack in seconds. If you need a new one, the passphrase generator builds one on your device.
Breach data comes from the Have I Been Pwned Pwned Passwords range API, run by Troy Hunt, and is used here without an account or an API key. Requests go directly from your browser to that service, so they are subject to its terms and privacy practices rather than ours; d4vinder.com is not in the path and sees nothing. Where the service supports it, the response is padded so an observer cannot infer the prefix from the size of the reply. Nothing you type on this page is logged by us, here or anywhere else.