- Have I Been Pwned checks if a password has leaked, without seeing the password itself.
- Your browser turns the password into a code and sends only the first 5 characters.
- Password managers like Bitwarden use the same check to warn about leaked passwords.
- The service handles more than 18 billion checks every month.
Have I Been Pwned is a free tool from security researcher Troy Hunt that checks if a password has ever leaked in a data breach. You can check a password on the site without sending your real password to Hunt's servers.
The privacy trick behind this is called k-anonymity. Cloudflare engineer Junade Ali suggested using it for Pwned Passwords, Hunt says. Your browser turns your password into a 40-character code called a SHA-1 hash.
Troy Hunt Pwned Passwords V2 launch
Your browser sends only the first 5 characters of that code to the Pwned Passwords service. The service sends back every leaked password hash that starts with those same 5 characters, sometimes hundreds of them.
Your browser then checks that list itself to see if the rest of your hash shows up in it. Have I Been Pwned never sees your full password or your full hash, only a small piece shared with hundreds of other passwords too.
Sending just 5 characters splits the whole leaked password list into about 1 million groups. Cloudflare helped design this grouping system, according to its own writeup on the approach.
Cloudflare k-anonymity implementation
Password manager Bitwarden uses this same service to warn people when a saved password has leaked. It calls this check its Data Breach report. Bitwarden says the check runs locally, so it never sees an unencrypted password. Most of its other security reports need a paid plan, but Bitwarden says the Data Breach report is free for everyone.
Have I Been Pwned says its password checking service now handles more than 18 billion requests a month. That traffic runs through Cloudflare's network, according to the site.
