Check whether a password has appeared in a known data breach, using the same privacy-preserving technique Have I Been Pwned itself recommends: your password is hashed with SHA-1 in your browser, and only the first 5 characters of that hash are ever sent anywhere - never the password, never the full hash.
How it works: your password is hashed locally with SHA-1. Only the first 5 hex characters of that hash (e.g. "5BAA6" out of "5BAA61E4C9...") are sent to the Have I Been Pwned Pwned Passwords API, which returns every breached hash sharing that prefix - typically hundreds of them. The match against your full hash happens locally, so the service never learns your password or even your full hash.
Your password is hashed locally with SHA-1 via the Web Crypto API; only the first 5 hex characters of that hash are sent to the Have I Been Pwned Pwned Passwords API, which returns every breached hash sharing that prefix (typically hundreds), and the exact match against your full hash happens entirely in your browser - so neither your password nor your full hash is ever transmitted.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.
Say thanks — $3