Tenlock

Check your personal exposure

Two free checks: whether a password of yours has turned up in a data breach, and whether your email address has. Both come with plain English about what it means and what to do.

Has your password been exposed?

Type a password below to find out whether it has appeared in a known data breach. It never leaves this browser.

Has your email been in a data breach?

Enter an email address to see which known breaches it has appeared in, and what was exposed in each one.

How are your security habits?

Thirteen questions, about three minutes. There are no wrong answers to be embarrassed about, and answering honestly is the only way the result is worth anything. If you do not know, say so: that is a real answer and it is treated as one.

Your answers stay in this browser. They are not saved and not sent anywhere.

Passwords, sign-in and getting back in

Do you use a password manager?

An app that creates and remembers strong passwords for you.

Do you use the same password, or close variations of it, on more than one account?
Does your main email account have two-step verification?

Where you confirm a sign-in with your phone or an app, as well as your password.

Do your other important accounts have two-step verification?

Banking, social media, shopping.

If you were locked out of your main email account today, could you get back in?

That means having a recovery phone number or backup email address that is still up to date.

Your devices

Do your phone and computer install updates automatically, or do you install them soon after they appear?
Do your devices lock with a PIN, fingerprint or face unlock?
Is the built-in security protection on your computer turned on?

Windows Security or Microsoft Defender on Windows, or the protection built into macOS.

Everyday habits

When an unexpected email or text asks you to click a link or verify your account, what do you usually do?
Have you ever shared a password with someone by text, email or messaging app?
Do you install apps and software only from official sources?

The App Store, Google Play, or the software maker’s own website.

Old accounts

Do you have old online accounts you no longer use?

Old email addresses, shops, forums, apps you signed up to once.

Backups

Are your important files and photos backed up somewhere separate?

Cloud backup, or an external drive.

0 of 13 answered

Your password stays in this browser

We never send it anywhere. Here is exactly what happens when you press Check:

  1. Your browser turns the password into a 40 character fingerprint. This only works one way, so the fingerprint cannot be turned back into your password.
  2. Only the first five characters of that fingerprint are sent to the breach database.
  3. It sends back every leaked fingerprint starting with those five characters, around a thousand of them.
  4. Your browser looks for yours in that list, here on your own machine.

So the database only ever learns that somebody asked about one of a thousand possible passwords. It never learns which one, and it never sees your password.

You do not have to take our word for it. Press F12 to open your browser’s developer tools, choose the Network tab, then run a check. You will see a single request with five characters at the end of it, and nothing else.

Your email address is treated differently, and here is why

The password trick above does not work for the breach search, which needs a paid key that cannot safely live inside a web page. So the email check works differently, and we would rather say so than let you assume otherwise.

When you check an email address, it is sent to our server, which passes it to Have I Been Pwned and hands the answer straight back to you. There is no database, and our own code writes nothing down.

There is a second place an address can escape, and it is worth explaining because almost nobody checks it. Hosting companies usually keep their own record of the requests a site makes on your behalf, and that record would have included the address you asked about. We went looking, found it happening here, and turned it off. Our host still records that a check took place and when, but no longer who it was for.

Even so, the password check above is the safer of the two, because it never reaches our server at all. That one is protected by the way it is built. This one is protected by the way it is set up, and those are not quite the same promise.

One detail you can verify yourself in that same Network tab: the address is sent in the body of the request rather than in the web address. Anything in a web address tends to end up in server logs by default, and a log is just a slower way of storing something.