Back to Tools

Identity ยท Breach exposure

Check a password against known breaches

The only Gealo microtool that makes a network call. Even so - your password never leaves this tab. Only the first 5 characters of its SHA-1 prefix are sent (k-anonymity).

k-anonymityNetwork exceptionHaveIBeenPwned

Confirm: this tool makes a network call

Every other Gealo microtool is 100% offline - file content never leaves your device. This one is the single named exception. We use HaveIBeenPwned's k-anonymity API: your password is hashed locally with SHA-1, and only the first 5 hex characters of the prefix are sent. The remote service returns ~500-1000 possible matches; the actual match (or non-match) is determined here, on this tab.

Your password never transits the network. Neither does the full hash. Only the prefix.

K-anonymity means even HIBP cannot know which password you checked - they see only the 5-character prefix and return all hashes that share it. A "safe" result means the password isn't in HIBP's breach corpus; it does not mean the password is strong. Combine this with a password strength estimator (e.g. zxcvbn) before adopting any candidate.