ToolsCVE trackerATT&CKCIDRDNSEmail securityHeadersTrackersTLSMy connectionCSP builderEmail headersJWTCert decoderPassphrasePassword checkHash & encodesecurity.txtDNSSEC & CAA

d4 · tools · password exposure check

Password exposure check.

Find out whether a password has turned up in a known data breach, without ever sending it anywhere. Your password is hashed on your device and only the first five characters of that hash are used to fetch a batch of candidates; the comparison happens here, in your browser.

What actually leaves your device

Five characters. Nothing else. The password is not sent to d4vinder.com, is not sent to Have I Been Pwned, and is not stored, logged or transmitted anywhere by this page. There is no form submission: the button is wired to run locally.

Check a password

Type or paste the password. If you would rather not type a real password into any page at all, that instinct is a good one, and the SHA-1 tab below does the same job from a hash you compute yourself.

Check a SHA-1 hash instead

If you already have the SHA-1 of a password, from our hash tool or your own scripts, paste the full 40-character hex digest. The same k-anonymity lookup runs, and the password itself never enters this page.

How k-anonymity works here

The technique is simple enough to check for yourself, which is rather the point.

  1. Your browser computes the SHA-1 of the password using crypto.subtle. This happens on your device, in memory.
  2. Only the first five hex characters of that hash are sent to api.pwnedpasswords.com. Around 800 to 1,000 hashes share any given five-character prefix, so the request identifies a crowd, not a password.
  3. The service returns every breached hash suffix under that prefix, along with how many times each was seen.
  4. Your browser looks for your own suffix in that list. The answer is worked out here; the service is never told whether there was a match.

SHA-1 is used because that is what the breach corpus is indexed by. It is not being relied on for security here: it is an index key, and the safety of the lookup comes from the prefix split, not the hash.

What a result means

A match means the password appears somewhere in a corpus of breached credentials. It does not mean one of your accounts was breached, and it says nothing about your email address or username. It does mean the password is in the lists attackers use for credential stuffing, so it should not be used anywhere, however complicated it looks.

No match means the password is not in that corpus. That is genuinely useful, but it is not a verdict on strength: a short or predictable password can be absent from every breach list and still fall to a guessing attack in seconds. If you need a new one, the passphrase generator builds one on your device.

Breach data comes from the Have I Been Pwned Pwned Passwords range API, run by Troy Hunt, and is used here without an account or an API key. Requests go directly from your browser to that service, so they are subject to its terms and privacy practices rather than ours; d4vinder.com is not in the path and sees nothing. Where the service supports it, the response is padded so an observer cannot infer the prefix from the size of the reply. Nothing you type on this page is logged by us, here or anywhere else.