Password Breach Checker
Check whether a password appears in public breach data without sending the password itself.
Result
This result uses the public Pwned Passwords dataset, which may not include every exposure.
A Privacy-Preserving Lookup
Your browser calculates the password SHA-1 hash and sends only its first 5 characters. The full hash and password are not sent to the external service or Utilook server.
Lookup data source: Pwned Passwords
How the range lookup protects the full hash
Your browser hashes the password and requests a list matching only the first five SHA-1 characters. The browser then compares the remaining hash locally. This k-anonymity design avoids sending the password or complete hash in the lookup request.
Act on both kinds of result
A match means the password should be replaced anywhere it is used. No match only means it was absent from the current dataset; it can still be weak, reused, or newly exposed. Prefer a password manager, a unique password, and multi-factor authentication.
Frequently Asked Questions
Does the breach lookup send my password?
No. The password and full hash are not transmitted; only the first 5 hash characters are used for the range lookup.
Why is SHA-1 used?
SHA-1 is not used to store your password. It is used only for the one-time hash comparison required by the Pwned Passwords range API.
Does a not-found result mean the password is safe?
No. It only means the password was not found in the public dataset. Use a long, unique password and multi-factor authentication.