Pwned Password Checker
Verify whether your password has appeared in known data breaches using Have I Been Pwned's zero-knowledge k-anonymity model. Plaintext passwords never leave your browser.
k-Anonymity Hash Range
Prefix: 5 Hex Chars Transmitted • 35 Suffix Chars Match Locally
Enter Password to Audit
SHA-1 Hashing5BAA6) are sent to the HIBP API range endpoint. The full password and full hash never leave your device.Awaiting Audit Inspection
The k-Anonymity protocol guarantees that neither SHRTX nor the remote API can determine your plaintext password.
Zero-Knowledge Password Breach Verification via k-Anonymity
The Pwned Password Checker allows individuals and security analysts to audit whether passwords have appeared in public data breaches compiled by Have I Been Pwned (HIBP). Exposure in credential dumps significantly elevates the risk of automated credential stuffing and dictionary attacks against digital accounts.
Security and privacy are guaranteed through strict implementation of the mathematical k-anonymity protocol. When you enter a password, the browser executes a SHA-1 cryptographic digest locally via the Web Crypto API. Only the first 5 hexadecimal characters of this 40-character hash (e.g., '5BAA6') are transmitted to the remote HIBP API range endpoint.
The remote endpoint responds with a list of all known hash suffixes sharing that common 5-character prefix. Your browser then performs a local, in-memory comparison against the remaining 35 characters. Your plaintext password and complete hash never leave client memory, ensuring complete zero-knowledge verification.
Core Tool Capabilities
- Browser-Native SHA-1 Cryptographic Hashing: Computes password hashes locally using the standard Web Crypto API before initiating any network transmission.
- Strict k-Anonymity Mathematical Model: Transmits only the first 5 hexadecimal characters of the hash, maintaining a large anonymity set of candidate passwords.
- In-Memory Suffix Matching: Compares the remaining 35 hash characters locally in memory to determine exact breach exposure count.
- Zero Plaintext Transmission or Storage: Plaintext passwords are never logged, stored in browser cookies, or sent across any network connection.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Auditing Master Passwords & Critical Credentials
- • Password Policy Compliance Verification
- • Credential Stuffing Vulnerability Audits
- • Educational Security Demonstrations
Technical Specifications & Platform Limits
Local browser-native digest generation.
Anonymity set containing hundreds of hash suffixes.
Official HIBP range endpoint with response padding.
Input discarded immediately upon clearing.
Step-by-Step Workflow
Enter Password in Audit Input
Type or paste the password you wish to evaluate. You can toggle visibility to ensure accuracy.
Execute Local SHA-1 Hash Calculation
Click Check Breach Exposure. The browser computes the 160-bit SHA-1 digest in local memory.
Dispatch 5-Character Prefix Range Query
The client queries the HIBP range API using only the first 5 hexadecimal characters with privacy padding.
Evaluate Local Suffix Match and Results
The engine scans returned suffixes locally, reporting breach occurrences or confirming no known exposure.
Practical Real-World Use Cases
Auditing Master Passwords & Critical Credentials
Individuals checking if their master passwords or banking credentials have been compromised in data dumps.
Password Policy Compliance Verification
System administrators verifying that newly generated service account passwords are not known breached passwords.
Credential Stuffing Vulnerability Audits
Security engineers investigating past passwords to determine vulnerability to credential stuffing attacks.
Educational Security Demonstrations
Instructors demonstrating the practical mathematics of k-anonymity and secure zero-knowledge API architectures.
Frequently Asked Questions
- Is my plaintext password sent to Have I Been Pwned or SHRTX?
- No. Neither SHRTX nor Have I Been Pwned ever receives your plaintext password or full hash. Your browser calculates the SHA-1 hash locally and sends only the first 5 hexadecimal characters (1/8th of the hash) to HIBP.
- What is k-anonymity?
- k-Anonymity is a mathematical privacy guarantee where individual data is blended into a group of at least k individuals. Sending only 5 characters returns hundreds of matching hashes, making it impossible for the server or eavesdroppers to determine which specific password was checked.
- If the tool reports zero breaches, is my password completely safe?
- Not necessarily. A clean result means the password does not appear in known public data breaches indexed by HIBP. However, a weak or simple password (like 'Winter2026!') could still be easily guessed through brute-force attacks.
- Does this tool store my password in history or local storage?
- No. The password exists only ephemerally in active React state memory and is never written to disk, local storage, session storage, or analytics logs.
- Why does the tool require internet access?
- An internet connection is required to fetch the anonymous hash suffix range dataset from Have I Been Pwned. However, all cryptographic hashing and final matching occur entirely in your local browser.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind Pwned Password Checker - Zero-Knowledge Breach Verification with our deep-dive educational content.