crackthe.net
Check for leaked passwords: how k-anonymity keeps the check private
How a password manager checks your passwords against leaked ones without sending them, what Have I Been Pwned's range search does, and what to do with a match.
Key points
- Lists of leaked passwords are public. A password on such a list is tried first in attacks, no matter how long it is.
- The service Have I Been Pwned lets apps check a password without sending it: only the first 5 characters of its hash leave your device.
- Password managers use such checks to warn you. Change every password they flag, starting with your email.
Why leaked passwords matter
When a website is breached, its passwords often end up in public lists. Attackers try these lists first, on every website. A password that appears there is unsafe even if it is long and random, because it is no longer secret.
The US standards body NIST therefore tells websites to check new passwords against such lists and to reject the ones on them.
How the check works without giving away your password
Have I Been Pwned, a service run by the security researcher Troy Hunt, collects passwords from data leaks. Its Pwned Passwords search works like this:
- Your app turns the password into a hash with the method SHA-1, on your device. The hash of “password,” for example, starts with 5BAA6.
- The app sends only the first 5 characters of the hash to the service.
- The service answers with the remaining characters of every leaked hash that starts the same way.
- Your app compares this list with the rest of its own hash, again on your device.
Many leaked hashes share the same first 5 characters, so the service cannot tell which password you checked. This is called k-anonymity. The search needs no API key, and Have I Been Pwned states more than 18 billion requests a month.
What the managers listed here check
| What the maker states | |
|---|---|
| 1Password | Watchtower warns about breaches, vulnerable passwords, reused and weak passwords, and websites that offer two-factor sign-in |
| Bitwarden | the report on exposed passwords sends the first five characters of each password’s hash to a service of known leaked passwords; most reports need Premium, the report on data breaches is free and uses Have I Been Pwned |
| Proton Pass | alerts for weak and reused passwords on every plan; dark web monitoring with paid plans |
| Keeper | not checked |
What to do with a match
- Change the flagged password on that website, and let the manager create the new one.
- Start with your email account, because it can reset all others, then banking and shopping.
- Change it everywhere you reused it. A leaked password opens every account that uses it.
- Turn on two-factor sign-in for the accounts that offer it. It stops logins with a known password.
- Run the check again after a few weeks. New leaks appear all the time.
Next step
The page Password managers compared lists the four managers with their free plans, devices, and CVE entries.
The figures in this guide come from the archive and change with every data update. As of November 13, 2026.
Check it with the archive's data
Read next: Check security headers, HTTPS, and DMARCAll guides