Find out if a password has already shown up in known breaches, without it ever leaving your browser.
Data breaches expose billions of email/password combinations every year, and attackers reuse those lists in credential stuffing attacks, trying the same breached password against dozens of other services. This tool queries Have I Been Pwned's Pwned Passwords database, maintained by Troy Hunt, which gathers over 900 million passwords already seen in real breaches. The technique used, k-anonymity, is what makes the lookup safe: your password is turned into a SHA-1 hash right inside your browser, and only the first 5 characters of that hash (out of 40 total) are sent over the network. The API returns a list of a few hundred hashes sharing that prefix, and the final comparison, to see whether your password's full hash is in that list, happens entirely in your browser. Unlike the Password Strength Auditor (which only theoretically estimates how hard a password would be to guess), this tool answers an objective question: has this specific password already shown up in a real breach?
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/leaked-password-checker"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="Leaked Password Checker"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
No. The full password never leaves your browser. It is turned into a SHA-1 hash locally, and only the first 5 characters of that hash (out of 40 total) are sent to the Have I Been Pwned API. It is mathematically impossible to reconstruct the original password from that prefix.
The check uses Have I Been Pwned's Pwned Passwords database, with billions of passwords from real breaches. Your password is hashed right here in your browser, and only a small piece of the hash is ever queried.
The password is turned into a SHA-1 hash right on your device, using the browser's Web Crypto API. Only the first 5 characters of that hash (not the password, not the full hash) are sent to the API. The API returns every hash that starts with that prefix, and the comparison against the full hash happens locally, in your browser. This method is called k-anonymity and is the same one used by the official Have I Been Pwned website.
No password or full hash is ever sent, stored or logged by J-Kit. The lookup uses Have I Been Pwned's public Pwned Passwords API directly from your browser.