Core Ripper Ripper
Back to Developer Tools

Password Breach Checker

Check if a password has appeared in a known data breach.

Your full password never leaves this browser tab and is never sent to CoreRipper's servers only the first 5 characters of its SHA-1 hash are sent to the lookup service. See "How this works" below.
How this works (k-anonymity)
  1. Your password is hashed with SHA-1, entirely in this browser tab, using the Web Crypto API.
  2. Only the first 5 characters of that hash (the "prefix") are sent to Have I Been Pwned's public range API.
  3. The service returns every breached hash suffix that starts with that prefix typically hundreds of them not knowing which one is actually yours.
  4. The remaining 35 characters are compared locally, in this tab, against that list. The full hash and the password itself are never transmitted.