AAmniat

← Toolkit

Guest tool

Password check

See whether a password has appeared in known data leaks, without sending the password itself to us or to Have I Been Pwned.

How this check stays private

This uses a method called k-anonymity, through Have I Been Pwned’s free Pwned Passwords range API. It works like this:

  1. Your browser hashes the password locally with SHA-1. The password never leaves this device.
  2. Only the first five characters of that hash are sent to Have I Been Pwned.
  3. Have I Been Pwned returns a padded list of hash suffixes that share the same prefix — many possible passwords, not yours alone.
  4. Your browser looks for a match in that list. Amniat never sees the password, the full hash, or the result.

Because only a short prefix is sent, the service cannot tell which password you typed. That is the point of k-anonymity. A match means the password has appeared in known leaks and should not be used.

Check a password

Optional, and free. Type a password below to run the k-anonymity check described above. The password itself never leaves this device.