Check whether a password appears in known data breaches — the password itself never leaves your browser.
Attackers rarely guess passwords one at a time. They take the credential dumps from breached sites and try those exact passwords on every other service — e-mail, banking, work accounts. That is credential stuffing, and it works because passwords get reused. This page tells you whether a password of yours is already in those dumps, by querying Pwned Passwords, the database maintained by Have I Been Pwned, which indexes billions of passwords from public breaches and reports how many separate times your exact password appears there.
Asking a service about a password normally means handing it over — exactly what you should never do. The k-anonymity model removes that problem. Your browser calculates the SHA-1 hash of the password, a 40-character code that cannot be reversed into the original text, and sends only the first five characters of it. The database replies with every leaked hash beginning with that prefix — a couple of thousand of them, from passwords unrelated to yours — and the final comparison happens in your browser. The service cannot tell which of those thousands you asked about. The request also carries a padding header, so every response comes back at a uniform size and even its length gives nothing away. Nothing reaches Vai.la: the request goes from your browser straight to the password database, and this page stores and logs nothing.
A password found even once should be treated as burned: change it everywhere you used it, starting with e-mail — the account that can reset all the others — and with anything financial. A high count means it is not only leaked but common, sitting near the top of every attacker word list; "123456" appears tens of millions of times. A count of zero is good news but not a clean bill of health: it means this exact string is not in the collection this database indexes, not that it never leaked and not that it is hard to guess. Breaches take months to become public, and short passwords fall to brute force without ever appearing in a dump. The durable fix is a different random password per site, kept in a password manager, with two-factor authentication on the accounts that matter.
SHA-1 produces 160 bits, written as 40 hexadecimal characters. The prefix that is sent is the first 5 of them — 20 bits, or 1,048,576 possible prefixes. Pwned Passwords indexes billions of hashes, so one prefix currently answers with a couple of thousand of them, decoys included. The service learns one prefix out of 1,048,576 and never sees the remaining 140 bits, and the exact number of hashes it returned is shown with the result.
No. Your browser hashes it locally with SHA-1 and sends only the first five characters of that hash, straight to the Pwned Passwords API. The password and the other 35 characters never leave the page, and Vai.la receives nothing. You can confirm it in your browser's network tab.
It answers about the prefix, not about your password. Every leaked hash starting with those five characters comes back in one list — a couple of thousand entries — and your browser does the matching. The service only ever sees a prefix that thousands of unrelated passwords share.
No, and this is the most misread part of the result. It only means the exact string is not in the breaches this database indexes. It may have leaked somewhere that never became public, and a short or predictable password is cracked by guessing without ever leaking.
Not necessarily. The count is how often that password string appears across all indexed breaches, from any user anywhere. A common password reaches millions of occurrences with no connection to you — but it is on every attacker word list, so change it wherever you use it.
From Pwned Passwords, the free service run by security researcher Troy Hunt as part of Have I Been Pwned. It aggregates passwords from public breaches and grows as new ones are processed, so a very recent breach may not appear yet. The check runs live when you click.
Vai.la turns any URL into a short link with click statistics, QR Code and your own biolink.
Vai.la is not responsible for how the tools are used or for decisions made based on their results.