Ascending sequence
- Input
- 123456, 1234567, 12345678
- Expected output
- Todas entre as senhas mais vazadas já registradas
Length variations don't help, the pattern is still obvious.
Carregando ferramenta… / Loading tool…
is 123456 a leaked password
"123456" is, year after year, the world's most common password. See the real breach-database result below, computed entirely in your browser, without the password or its full hash ever leaving your device.
Length variations don't help, the pattern is still obvious.
Use the Password Generator to create a real one.
210,461,208 is the number of times this exact password has already shown up in breaches cataloged by HIBP.
No. The full password never leaves your browser. It is turned into a SHA-1 hash locally, and only the first 5 characters of that hash (out of 40 total) are sent to the Have I Been Pwned API. It is mathematically impossible to reconstruct the original password from that prefix.
Because "123456" is a public, universally known sequence, the world's most common password, it is not a specific person's secret. It is used here purely to demonstrate how the tool works with an example anyone recognizes.
No. Automated attacks test obvious variations (123456!, 123456a, Password123456) as a standard part of common-password lists. The problem isn't the number itself, it's the predictability.
It is the sum of every time that hash appeared across any breach Have I Been Pwned has already processed, so it includes both different people and the same account reused across separate datasets, the number does not distinguish between the two.
Because here SHA-1 is not protecting any secret, it only serves to quickly index a giant database of already-public passwords and let the browser compute the hash in milliseconds without stalling the page; SHA-1's weakness against deliberate collisions is irrelevant to this specific use.
The check uses Have I Been Pwned's Pwned Passwords database, with billions of passwords from real breaches. Your password is hashed right here in your browser, and only a small piece of the hash is ever queried.
The password is turned into a SHA-1 hash right on your device, using the browser's Web Crypto API. Only the first 5 characters of that hash (not the password, not the full hash) are sent to the API. The API returns every hash that starts with that prefix, and the comparison against the full hash happens locally, in your browser. This method is called k-anonymity and is the same one used by the official Have I Been Pwned website.
No password or full hash is ever sent, stored or logged by J-Kit. The lookup uses Have I Been Pwned's public Pwned Passwords API directly from your browser.