Skip to content
BetterPass logo

Breach Checker — Passwords & Email Monitoring

Check a password with privacy-preserving k-anonymity, screen a batch of passwords, or monitor an email address against known breaches.

Privacy:Your password never leaves your browser. Here's how: the tool sends only the first 5 hex characters of your password's SHA-1 hash — this privacy trick is called "k-anonymity". The full hash stays on your device.
Batch Checkone password per line (max 100)

What is Breach Checker?

This tool checks whether your password has appeared in known data breaches using the Have I Been Pwned (HIBP) k-anonymity API, and monitors an email address for breach exposure with a full risk report.

Password check (k-anonymity) — only the first 5 characters of your password's SHA-1 hash leave your browser. The full hash never does.
Email breach report — the email tab returns a risk score, per-breach detail (domain, industry, year, records, exposed data types, password storage risk), paste exposure, and password strength breakdown.
Batch check — screen up to 100 passwords at once. Requests are grouped by hash prefix so each prefix is fetched only once.
Recent checks — your last 10 password checks and 8 email checks are stored locally (summary only).
Billions of breached credentials — HIBP aggregates data from hundreds of breaches including LinkedIn, Adobe, Yahoo, and more.

Zero-Server Tool Data Guarantee

Password checks run entirely in your browser: only the first 5 hex characters of the SHA-1 hash are sent to HIBP using k-anonymity. Email monitoring sends the email address directly from your browser to the XposedOrNot API — BetterPass's server never sees it. Results are cached locally for 24 hours.

How to Use

01

Choose Password or Email

Use the toggle at the top. Password checks stay in your browser via k-anonymity; the email tab queries a breach-check API directly.

02

Check a Password

Type or paste a password and click Check. The tool hashes it locally and queries HIBP with k-anonymity.

03

Check an Email

Enter an email and click Check Email to get a full report: risk score, affected services with exposed data types, and any paste exposures.

04

Screen a Batch

Paste up to 100 passwords (one per line) and click Check all — results group by hash prefix to minimize requests.

05

Review History

Your recent password checks (hash prefix + result) and email checks (summary) are saved locally so you can track what you've verified.

Common Use Cases

Audit Current Passwords

Check passwords you're currently using — one at a time or in a batch — to see if they've appeared in any known data breaches.

Monitor Your Email

Use the email tab to get a full breach report: risk score, affected services, exposed data types, password storage risk, and paste exposure.

Pre-Registration Check

Before signing up for a new service, verify the password you plan to use hasn't been breached elsewhere.

Post-Breach Response

After a company announces a breach, check whether your specific password or email was exposed — then follow our step-by-step guide.

Implementation Examples

JavaScriptHow HIBP K-Anonymity Works
// 1. Hash password with SHA-1 locally
async function checkBreach(password) {
    const encoded = new TextEncoder().encode(password);
    const hashBuffer = await crypto.subtle.digest('SHA-1', encoded);
    const hash = Array.from(new Uint8Array(hashBuffer))
        .map(b => b.toString(16).padStart(2, '0')).join('').toUpperCase();
    
    // 2. Send only first 5 chars to API
    const prefix = hash.slice(0, 5);
    const suffix = hash.slice(5);
    
    const response = await fetch(
        `https://api.pwnedpasswords.com/range/${prefix}`
    );
    const text = await response.text();
    
    // 3. Check if full hash suffix appears in response
    return text.includes(suffix);
}

Breach Check Methods

MethodData returnedKey neededNotes
HIBP K-Anonymity (password, this tool)Breach countNoPartial hash only; billions of records
XposedOrNot breach-analytics (email, this tool)Risk score, per-breach detail, password storage, pastesNoRich report in one request; free tier rate-limited per IP
XposedOrNot check-emailBreach names onlyNoLighter payload, fewer details
HIBP domain/email APIBreach list + detailsYes (API key)Requires key; adds provider complexity
Send password to APIBreach countNone (password exposed)Password leaves your device
Manual paste into websitePer-site reportNoManual per email or password

Production Best Practices & Security

Check all your passwords — if any appear in a breach, change them immediately on every site where you used them. Why:Once a password is in a public breach list, automated scripts (bots) will attempt to use it on thousands of popular websites.
Monitor your email — the email tab shows a risk score, every affected service, and what data was exposed. Why:The sooner you know about a breach, the faster you can secure accounts before attackers use the data.
Change breached passwords first — prioritize accounts with sensitive data (email, banking, work). Why:Your email account is the "keys to the kingdom" — if an attacker has it, they can reset passwords for almost all your other accounts.
Enable two-factor authentication — even breached passwords are useless without the second factor. Why:2FA adds a layer that requires a physical device or app an attacker cannot easily obtain.
Use unique passwords everywhere — a breach on one site shouldn't compromise all your other accounts. Why:Reusing one password lets a breach at a random forum give attackers access to your bank.
Treat paste exposures seriously — addresses found in public dumps are frequently targeted by spammers and phishers. Why:Attackers actively harvest these lists for phishing and credential-stuffing attacks.

Frequently Asked Questions

Have I Been Pwned (HIBP) is a free service created by security researcher Troy Hunt that aggregates over 12 billion records from thousands of public data breaches. It lets anyone check whether their email addresses or passwords have been exposed.

BetterPass's Breach Checker queries the HIBP API using k-anonymity — a privacy-preserving model where only a partial hash prefix is sent. You can check credentials without disclosing them to any third party.

If your password appears, it has been compromised and should be changed immediately.