Pwned Password Check
Hash a password to its SHA-1 prefix and match a Pwned Passwords range response — entirely on this device.
SHA-1 hash
The SHA-1 appears here, split into the 5 characters that may leave this device and the 35 that must not.
Run the range request yourself
—Range URL —
Only the 5-character prefix travels in that request. The other 35 characters stay in this tab, so the server is never told which suffix you are looking for.
Result
Nothing has been matched yet — run the command above and paste the response body here.
A range response never repeats the prefix, so the match cannot prove the body came from the range URL above. That correspondence is yours to confirm.
A shared link carries only your shell choice and whether the sample is loaded. There is no state key that could hold a password or a response.
Press ? for shortcuts
Nothing here is stored between visits and nothing is put in a link — not the password, not the response.
This page loads no third-party code — no ads, no trackers, no analytics. Verify in your Network tab.
Do it offline:$ curl -s https://api.pwnedpasswords.com/range/5BAA6 | grep -i 1E4C9B93F3F0682250B6CF8331B7EE68FD8
How to use it
- Type or paste the password into the first field. It is masked, with a reveal toggle, and hashing runs on ⌘/Ctrl + Enter or as you type. The readout splits the forty hex characters into prefix and suffix, each separately copyable.
- Copy the range request from the transport card — a curl line, or Invoke-RestMethod for PowerShell. Only the five-character prefix sits in that URL. SHA-1 is the index the Pwned Passwords range endpoint publishes, so that is what is computed.
- Run the request in your own shell. It answers in plain text: one row per line, a hex suffix, a colon, then how many times that hash appears in the corpus. Roughly a thousand rows come back for any prefix.
- Paste that body into the response field and press Match. The verdict reads found with its count, not found in the response you pasted, or empty. Rows carrying a count of 0 are padding and read as not found.
Type a password and its SHA-1 is computed in this tab, then split into a five-character prefix and a thirty-five-character suffix. Copy the one-line range request, run it yourself, and paste the response back: the parser reports whether your suffix appears in what you pasted, and with what occurrence count. The prefix is the only fragment that ever travels, and it travels on your command. Nothing is uploaded, nothing is stored.
Examples
passwordSHA-1 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
prefix 5BAA6
suffix 1E4C9B93F3F0682250B6CF8331B7EE68FD8
range https://api.pwnedpasswords.com/range/5BAA6The demo password, and the most-cited SHA-1 in the field. Only the leading five of those forty characters reach the endpoint; the other thirty-five are matched locally. Five hex characters name one of 1,048,576 buckets — a bucket, not a password.
A582CD0BFDF27C0BAB44FC1D832830EF7E0:3
5E0270BAA885129CC5D56DB9C8BA46F79FD:118
1E4C9B93F3F0682250B6CF8331B7EE68FD8:7777
F9442CE870DE80327CE628E9DFF35AE825A:9
C2C2816B78D12CE1D7F7B486FDE6282E76B:12found · 7,777 occurrences · line 3 of 5 rowsA five-row synthetic body, trimmed to fit the page: the demo suffix sits on line 3, so the parser reports its count and its line. That count is a placeholder, and it describes the corpus rather than the person who typed the password. The four decoy rows are the SHA-1 suffixes of the strings ithomia-sample-1 to -4, so this body can be regenerated by hand.
63A035D939023B2EE0DB04DDDB47A00F793:41
1E4C9B93F3F0682250B6CF8331B7EE68FD8:0
5E0270BAA885129CC5D56DB9C8BA46F79FD:0
A582CD0BFDF27C0BAB44FC1D832830EF7E0:0not found · 4 rows read · 3 rows carry count 0The same suffix, now present with a count of 0 — an Add-Padding decoy. The endpoint can pad every response to a uniform size so its length leaks nothing, and padded rows always carry zero. Treating presence as a hit would invert the answer here.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
A count of 0 is padding, never a hit
Ask the endpoint for padding and it returns extra rows counted zero, so every prefix answers with a same-sized body. Presence in the response is therefore not the test; a count above zero is. Every match reports how many zero-count rows it saw.
Empty input, spaces and Unicode forms
An empty field is valid input and yields the SHA-1 of nothing, labelled as such rather than dressed up as a result. Spaces are never trimmed: a space is a password character. Composed and decomposed forms of an accented letter hash differently; that is noted, never normalised away.
An oversized body is refused, never half-read
Beyond 20,000 lines or 1 MB the paste is refused outright. Scanning part of a response could print not found for a password further down it — the one wrong answer this page must never give. Malformed rows are listed individually up to twenty, then counted.
Which prefix a body came from cannot be checked here
A range response never repeats the prefix it answered, so a body from some other prefix parses perfectly and matches nothing. Every result therefore says the link between the URL you ran and the text you pasted is yours to confirm.
Common errors
The pasted response starts with `{` at line 1, so it looks like an HTML or JSON error page rather than a range response. Re-run the range request and paste the body it returns: plain text, one `SUFFIX:COUNT` row per line.- The endpoint answered with an error document instead of a range; a rate-limit reply is the usual cause. Run it again and paste only the body.
None of the 2 lines in the pasted response is a `SUFFIX:COUNT` row, so there is nothing to match. Each line of a range response is a 35-character hex suffix, a colon, then a count.- Response headers or a shell prompt came along with the body. Re-copy from the first hex character onward.
The pasted response has 20,001 lines, above this tool's 20,000-line limit, so it was refused instead of partly scanned — a partial scan could report "not found" for a password that is in the response. A range response normally has 800–1,200 lines; paste one response at a time.- Two responses were pasted together, or this is not a range body. One response at a time keeps the verdict trustworthy.
FAQ
What does the endpoint learn from a five-character prefix?
Which of 1,048,576 buckets your hash falls into — sixteen possibilities per hex character, five of them — and nothing beyond that, since the identifying thirty-five characters are never sent. Any prefix answers with several hundred to a couple of thousand candidate suffixes, so one request fits them all equally. An address and a timestamp are visible too, which is why the request is yours to run.
Does a high occurrence count mean my account was breached?
No. The count says how many times that hash appears across corpora of previously exposed credentials: a statement about a string, not about you or any particular incident. What a match does tell you is that the string is in circulation, which is reason enough to change it wherever it is in use.
Why does this page not run the request for me?
This route issues no third-party requests at all, which you can confirm in your network panel. Handing over the exact command keeps the transport yours: the prefix travels when you press Enter in your own shell, and never otherwise.
Keyboard shortcuts
- ⌘/Ctrl + Enter
- Re-run the current step: hash, or match the pasted response.
- ⌘/Ctrl + S
- Download the .txt report — full SHA-1, prefix and suffix, verdict, counts — never the password, though treat it as sensitive. Intercepts the browser's save dialog.
- ⌘/Ctrl + C
- With no text selected, copy the range command from the transport card.
- ⌘/Ctrl + Shift + C
- Force that copy even with a selection active.
- ? or ⌘/Ctrl + /
- Open the shortcut help panel; Escape closes it.