Has your password been leaked? A free, private checker

Guide type

Free tool

Risk if leaked

High

Time

1 min

Cost

Free, no sign-up

Works on

Any modern browser

Last verified

2026-10-05

Password to check

Check

Show password Clear

The result will appear here. Nothing is stored or logged by this page.

Sent to the breach database: nothing yet

What your result means

Result	What it tells you	What to do
Found thousands or millions of times	A common password. It is near the top of every list attackers try first.	Replace it everywhere today.
Found a few times	Rarer, but it sits in at least one breach list. Attackers use these lists to try the same password on other sites ("credential stuffing").	Replace it everywhere. If it is your password, assume at least one of your accounts leaked it.
Not found	It is not in the known breach lists. It could still be short or easy to guess.	Keep it only if it is long, unique to one account, and not based on personal details.

A password that was found does not always mean your account was hacked. Someone else may have chosen the same password and leaked it. The risk is the same either way: attackers will try it.

How the check stays private

Typing a real password into a website should make you suspicious, so here is exactly what this one does:

1. Your browser converts the password into a SHA-1 fingerprint (a "hash"), for example 21BD12DC183F740EE76F27B78EB39C8AD972A757. This happens on your device.
2. Only the first 5 characters (21BD1) are sent to the free Pwned Passwords service run by Have I Been Pwned.
3. The service replies with every leaked fingerprint that starts with those 5 characters, usually several hundred. Padding is requested, so the reply size does not hint at the answer either.
4. Your browser looks for the rest of your fingerprint in that list. The service never learns which one, if any, was yours.

This method is called k-anonymity, and it is the same approach several browsers and password managers use for their own breach checks. The page does not save the password, does not send it to Zuuun, and does not use cookies for the tool. The line under the box shows exactly what was sent.

Prefer not to type a password into any web page? Run the same check on your own computer. This Python 3 script uses only the standard library and asks for the password without showing it:

import getpass, hashlib, urllib.request

pw = getpass.getpass("Password: ")
h = hashlib.sha1(pw.encode()).hexdigest().upper()
req = urllib.request.Request(
    "https://api.pwnedpasswords.com/range/" + h[:5],
    headers={"User-Agent": "pw-check"})
body = urllib.request.urlopen(req).read().decode()
counts = dict(line.split(":") for line in body.splitlines())
print(counts.get(h[5:], "0"), "times in known breaches")

If your password was found

1. Change it on your email account first

   Whoever controls your email can reset almost every other account. If you used the leaked password there, change it now and sign out of other sessions. Our guide for what to do after a phishing click covers the session and recovery checks in detail. If you are already locked out of a Gmail account, use our Gmail recovery steps instead.

2. Find every other account that uses it

   Reused passwords are the real danger. Make a quick list: banking, shopping, social media, work, cloud storage. Change the password on each one to a different password.

3. Let a password manager create the new ones

   Nobody can remember dozens of unique passwords. A password manager generates and fills them for you. The managers built into Google (Chrome and Android) and Apple devices are free and good enough to start; dedicated managers add sharing and work across every platform.

4. Turn on two-step verification or a passkey

   With a second step, a leaked password alone is no longer enough to get in. A passkey is stronger still, because there is no password to leak or to type into a fake page. Our passkey setup guide shows how to add one to your Google and Microsoft accounts.

5. Check whether your email address was in a breach

   Search your email address on haveibeenpwned.com to see which services leaked your data. You can also subscribe to free alerts for future breaches.

What makes a password strong in 2026

The US National Institute of Standards and Technology (NIST) rewrote its password guidance in its final SP 800-63B-4. The short version for everyday use:

• Length beats complexity. NIST requires at least 15 characters when a password is the only thing protecting an account, and at least 8 when it is combined with a second step.
• No forced symbol rules. Services should not demand "one uppercase, one number, one symbol". Those rules produce predictable passwords like Summer2026!.
• Breach checks are mandatory for services. Sites are expected to reject passwords that appear on lists of leaked or common values, which is exactly what this tool checks.
• Random words work. The UK's National Cyber Security Centre recommends three random words for passwords you must remember, such as your password manager's main password.

Other free ways to run this check

Your browser or password manager may already do it for you, using the same privacy method:

• Google Password Manager (Chrome and Android) has a Password Checkup that flags compromised, reused and weak passwords.
• Apple devices flag compromised passwords in the Passwords app under security recommendations.
• Most dedicated password managers include a breach report for all your saved passwords at once.

Running a small business? Breach-checked, unique passwords are one item of our small business cybersecurity checklist, together with the second step that makes a leaked password much less useful.

Sources

• Have I Been Pwned — Pwned Passwords API documentation
• NIST — SP 800-63B-4: Authentication and Authenticator Management
• NCSC (UK) — Three random words
• CISA — Use strong passwords
• Google — Password Checkup