We would like to count page views and clicks with Google Analytics, which sets cookies in your
browser. It is how we learn which pages are worth writing. Nothing loads until you choose, and
declining costs you nothing on this site. What we collect.
Two checks. The email lookup goes through our own edge, not a third party. The password check never leaves your browser at all.
Email address
Password (never sent)
Only the first 5 characters of a SHA-1 hash are sent to the Pwned Passwords range API. The password and the rest of the hash stay here.
Everything on this page runs in your browser. We do not log what you check, and no result — no address, no email, no speed figure — leaves your device. Analytics records that the tool was used, never what it returned. Privacy policy. Tool last reviewed 2026-09-06.
What a breach result means
Your address was in a database that was stolen from a service and later published or sold. Usually that means the password you used there is known too, either in plain text or in a form that has since been cracked. Attackers take those email-and-password pairs and try them on every major site — "credential stuffing" — which is how an old forum breach becomes a hijacked email account. The fix is not to stop using your email address; it is to stop reusing passwords, which makes every breach a local problem.
Why the password check is safe
The Pwned Passwords service holds hundreds of millions of leaked passwords as SHA-1 hashes. To check one without revealing it, your browser hashes the password and sends only the first five hex characters. The server returns every stored hash beginning with those characters — typically 500 to 1,000 of them — and your browser looks for the full hash in the list. The server learns nothing usable, and the check happens at your end. Cloudflare and the Have I Been Pwned team designed this together in 2018 and it is what browsers' own leaked-password warnings use.
Breaches and VPNs
People arrive at a VPN site because they are worried about being watched. Statistically, the thing most likely to actually go wrong for them is a reused password meeting a breach, not their ISP. That is why this tool is here. It runs alongside the password generator next door.
Frequently asked questions
How does the email breach check work?
It queries the Have I Been Pwned database, which indexes billions of accounts from published data breaches, through our own edge function so that your browser never talks to a third party directly. The result lists the breaches your address appears in, with dates and what kinds of data were exposed.
How does the password check work without sending my password?
Your browser hashes the password with SHA-1 and sends only the first five characters of the hash to the Pwned Passwords API. The API returns every hash suffix that starts with those five characters (several hundred), and your browser checks locally whether yours is among them. The service never sees your password or even enough of its hash to work it out. This is called k-anonymity.
My email is in a breach. What do I do?
Change the password on that service if you still use it, and on any other service where you used the same password — that is what breach data is used for. Turn on two-factor authentication where the service offers it. If the breach exposed a password you use for email, do email first. A password manager makes the rest of this a one-time job.
Does a VPN protect me from data breaches?
No. A breach is the service being hacked, not your connection. A VPN could not have prevented any of the breaches this tool reports. Unique passwords and two-factor authentication are the defence.
Do you store the email I check?
No. The request passes through our edge function to look it up and the answer is returned to your browser. Nothing is written down. The password check never involves us at all; it goes from your browser to the Pwned Passwords range API.
Why does it say the email check is unavailable?
The breached-account lookup requires an API key we pay for. If the key is missing or the quota is exhausted, the tool says so rather than pretending. The password check does not need a key and always works.