Attackers don’t guess passwords — they replay leaked ones. This checks yours against the Have I Been Pwned corpus of real breach data, using a trick that means the password itself never leaves your browser.
how it stays private (k-anonymity): the password is hashed on this page; only the first 5 characters of the hash are sent. the API returns ~800 candidates and the match happens here. verify it yourself in devtools → network.
↑ sent · the rest never leaves your device
Change it everywhere it’s used, starting with email and banking — attackers try leaked credentials against every major service within hours of a breach. Then stop generating passwords with your brain: a password manager makes every login unique, which turns any future breach into a one-account problem. If you’re setting this up for a whole team and want it done right, that’s a thing I do — or start with the stack self-audit.
Still uncomfortable typing a real password here? Good instinct — that wariness protects you. Check a retired one instead, or read how the Pwned Passwords data works.