If you reuse the same password on email, shopping, and banking, one company breach can unlock the rest. Free PassBreach checks whether a password appears in known breach datasets — without sending your full password to our servers.
How it works (plain English)
- You type a password in your browser.
- Your device turns it into a fingerprint (hash) and only sends a short prefix to a public breach API (Have I Been Pwned style k-anonymity).
- You learn if that password shows up in known dumps — then you should change it everywhere you reused it.
You still shouldn’t type a password on a shared or untrusted computer.
What to do if it’s been seen before
- Change it on email first (email is the master key).
- Change it on banking and shopping sites that shared that password.
- Turn on two-factor authentication where you can.
- Use a different strong password per important site — a password manager helps; or write unique ones in a safe place if managers feel like too much.
- Optional: try PassGen for a strong new one.
FAQ
- Is this free? Yes. No signup.
- Do you store my password? The design keeps the full password on your device; only a short hash prefix leaves for the range lookup.
- I’m not techy — is this for me? Yes. Type → check → change anything that’s been exposed.