Has your data been leaked?
Nothing you type is kept: your password never leaves your device, and your address never goes through our server — only a hash of it, for LeakCheck.
When you click, your address goes from your device to XposedOrNot. For LeakCheck, only 24 characters of its hash, computed here, go through our server, which keeps nothing.
How it works
- You type your address and click “Check”.
- Your device asks XposedOrNot, and LeakCheck through a hash that goes via our server: two free services that list known breaches.
- You see each breach, what leaked, and what to do.
Good habits
A good password is long — three or four random words — and different for every site. A password manager remembers them for you.
- Use a password manager: a long, different password for every site, without the effort.
- Turn on two-factor authentication wherever you can, starting with your email.
- Be wary of emails that mention one of these sites or rush you to act: it is the most common scam after a breach.
Strength, calculated on this device
—
Your password never leaves this device: its fingerprint is calculated here, only its first 5 characters (out of 40) are sent to Have I Been Pwned, and the rest is looked up here.
Checked with Pwned Passwords, by Have I Been Pwned. · zxcvbn-ts (MIT)
Good habits
A good password is long — three or four random words — and different for every site. A password manager remembers them for you.
- Turn on two-factor authentication wherever you can, starting with your email.
- Be wary of emails that mention one of these sites or rush you to act: it is the most common scam after a breach.
The public breach catalogues of Have I Been Pwned and XposedOrNot, combined without duplicates. Your device downloads them when you open this tab.
To get an email when your address appears in a NEW breach, two free services can do it for you. They first write to you to check that the address really is yours.
These are their services: you give them your address directly, without going through us.
Good habits
- Use a password manager: a long, different password for every site, without the effort.
- Turn on two-factor authentication wherever you can, starting with your email.
- Be wary of emails that mention one of these sites or rush you to act: it is the most common scam after a breach.