Cybersecurity

Check If Your Password Was Leaked Safely

Billions of passwords have been stolen in data breaches, and yours may be among them. Checking is smart — but the way you check matters enormously, because a bad checker can steal the very password you are testing. This guide explains how safe checking works, how to recognise a dangerous one, and exactly what to do if your password was leaked.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Why you should check

Passwords stolen in breaches are not deleted when the news cycle moves on. They are traded, combined with other breaches, and tried automatically against email, banking, shopping and social media accounts — a technique called credential stuffing. A password you used five years ago on a forum you forgot about may be tried against your email account this week.

Checking matters most for passwords you reuse. If a password appears in a known breach and you used it on ten accounts, all ten are at risk, even though only one service was breached. Checking tells you which passwords are burned, so you can replace them before an attacker tries them somewhere else.

Checking is also how you find out about breaches you never heard of. Most people have accounts on dozens of services, and a breach at a small one is easy to miss. A single check of your email address and your most important passwords can reveal a problem you did not know existed.

How a safe password check works: k-anonymity

A safe password check never sends your full password to anyone. Instead it uses a technique called k-anonymity, and the idea is simple once you see it. First, your password is turned into a one-way fingerprint called a hash, on your own device. A hash is a fixed-length string produced by a mathematical function: the same password always produces the same hash, but the hash cannot be turned back into the password.

Second, only the first few characters of that hash — the prefix, usually five characters — are sent to the service. The service does not receive your password, and it does not receive your full hash. It replies with a list of all the hash suffixes that share that same prefix — hundreds or thousands of them — and your device checks privately whether your full hash is among the list.

Because the prefix is shared by many different passwords, the service cannot tell which password you were checking. The anonymity comes from the crowd: the technique is named k-anonymity because your query is hidden among k others. Your full password never leaves your device, your full hash is never sent, and nothing you typed can be reconstructed from what was transmitted. That is the safe way — local-only checking, with only a short hash prefix exchanged. This site does not run a live breach checker, so apply the test above to any checker before you trust it with a password.

How to tell a safe checker from a dangerous one

A safe checker explains its method. It says, in plain language, that it uses k-anonymity, that your full password never leaves your device, and that it does not store what you checked. It asks for a password, not for your email address and password together, and it does not require you to create an account or sign in to check. The best-known public example of this model is the password checking service run by Troy Hunt's Have I Been Pwned project, which documents the k-anonymity design openly.

A dangerous checker does the opposite. It asks you to type your full password into a form that sends it to a server. It asks for your email address and your password together. It requires an account, a payment, or a download before it will show a result. It gives no explanation of how it works, or it claims to check against live databases it cannot plausibly have. Any checker that behaves like that should be closed immediately — it may be harvesting the very passwords people are trying to protect.

A useful test is your browser's network view: a safe checker sends only a short hash prefix, and you can verify what leaves your device. You do not need to be technical to apply the simple rule: if a site asks for your whole password, do not give it to them.

• Safe: explains k-anonymity, no full password ever sent, no account needed.
• Safe: asks for a password alone, not email plus password together.
• Dangerous: asks for your full password, requires sign-in or payment.
• Dangerous: gives no explanation of how it works.

Checking an email address vs checking a password

Checking an email address answers a different question: has this address appeared in a known breach? That is useful, because it tells you which services lost your data, and what was taken. Reputable breach notification services let you look up an address without creating an account, and they tell you the breaches, the dates and the data types involved. They do not ask for your password.

Checking a password answers a narrower question: has this exact password appeared in a known breach? A password can be breached even if your email address was not in the same breach, because the same password may have been used — and stolen — under someone else's account. Both checks are worth doing, and they use different methods.

Do the email check first, then the password checks for your important accounts, starting with email and banking. If either check comes back positive, act on it the same day: the password is burned, and it should be replaced everywhere it was used.

What to do if your password was leaked

Change the password immediately, on every account where you used it — not just the account involved in the breach. Start with your email, because access to your email lets an attacker reset almost everything else. Choose a long, unique replacement; a password manager makes this easy, and this is the moment to start using one if you do not already.

Turn on two-factor authentication on the affected account and on your email account. Then check the account for signs of misuse: unfamiliar logins, new devices, changed recovery details, messages you did not send, or forwarding rules you did not set. If you see activity you do not recognise, tell the service and change the password again from a clean device.

If the leaked password was used on a banking or payment account, contact your bank, check your statements for unfamiliar transactions — including small ones — and ask the bank to watch the account. If the breach also exposed identity documents, consider a fraud alert or a credit freeze with the credit reference agencies in your country. Our guide on what to do after a data breach covers the full response in order of risk.

What to do if your password was NOT leaked

Good news — but do not stop there. A clean result means the password has not appeared in the known breach collections that the service checks, not that it is strong or that it will never leak. Keep the habit that prevents future problems: unique passwords per account, a password manager to generate and store them, and two-factor authentication on email, banking and social media.

Re-check your important passwords every few months, and always after a breach is reported at a service you use. Breach collections grow constantly, and a password that is clean today may appear tomorrow. Treat the check as routine maintenance, like a smoke alarm test — quick, boring, and exactly the kind of thing that matters when it matters.

Finally, close accounts you no longer use. Every old account holding your details is another breach waiting to happen, and a breach at a service you forgot about is still a breach of your data.

Sources

• National Cyber Security Centre (UK) — Password guidance — last checked 14 November 2026.
• NIST — SP 800-63B Revision 4, Digital Identity Guidelines — last checked 14 November 2026.
• CISA — Cybersecurity best practices — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

Is it safe to type my password into a leak checker?

Only if the checker uses k-anonymity: your password is hashed on your own device and only the first few characters of the hash are sent, so your full password never leaves your device. Never type your full password into a site that does not explain this method, and never enter your password and email together on an unfamiliar site.

What is k-anonymity?

K-anonymity is a privacy technique used in safe password checks. Only a short prefix of your password's hash is sent to the service, which returns all hashes sharing that prefix. Because many passwords share the same prefix, the service cannot tell which password you were checking.

Can a website steal my password if I check it?

A dishonest site could, which is why you should only use a checker that explains its k-anonymity method and never receives your full password. Do not use a checker that asks for your full password, requires an account, or demands payment before showing a result.

My password was leaked. What first?

Change it immediately on every account where you used it, starting with your email. Turn on two-factor authentication on the affected account and on your email, then check for unfamiliar logins, changed recovery details, or messages you did not send.

How often should I check my passwords?

Check your important passwords every few months, and always after a breach is reported at a service you use. Breach collections grow constantly, so a password that is clean today may appear tomorrow.