Protegy security tool · updated 2026-08-20
Pwned password checker
Check a password against the live Pwned Passwords dataset without sending the password to Protegy or Have I Been Pwned.
Transparent inputs · no analytics event contains your value
Your browser will hash the password locally. Only the first five SHA-1 characters are sent to the Pwned Passwords range API with response padding enabled.
How to use this result
A match means the password has appeared in the Pwned Passwords corpus and should not be used. No match is not proof that a password is safe; uniqueness, length, and two-factor authentication still matter.
Live data source and privacy model
The check uses the free Pwned Passwords range API. Protegy computes SHA-1 locally, sends only a five-character prefix, compares the returned suffixes in the browser, enables response padding, and clears the password field after the result.
Have I Been Pwned API documentation ↗