We use essential cookies to run CoreRipper, and optional personalization/analytics/advertising cookies to remember things like your theme and improve the free tier. See our Cookie Policy.
Check if a password has appeared in a known data breach.
Your full password never leaves this browser tab and is never sent to CoreRipper's servers only the first 5 characters of its SHA-1 hash are sent to the lookup service. See "How this works" below.
Recent Major Breaches
Auto-updated weekly
How this works (k-anonymity)
Your password is hashed with SHA-1, entirely in this browser tab, using the Web Crypto API.
Only the first 5 characters of that hash (the "prefix") are sent to Have I Been Pwned's public range API.
The service returns every breached hash suffix that starts with that prefix typically hundreds of them not knowing which one is actually yours.
The remaining 35 characters are compared locally, in this tab, against that list. The full hash and the password itself are never transmitted.