AltF Security

Has my password been leaked?

Type a password below to see whether it appears in the Pwned Passwords breach list and how long it would take to crack. The check is private: your browser hashes the password and sends only the first 5 characters of the hash, so neither AltFTool nor the breach service ever sees the password itself.

  • Free, no sign-up
  • Passwords never leave your browser
  • No fake scans or scores
  • Works on mobile

Password check

See how strong a password is and whether it appears in known data breaches. It is hashed in your browser; only 5 characters of the hash are sent.

Results appear as you type. Nothing is sent until you press Check breaches.

Strength is calculated on this page. The breach check uses Have I Been Pwned's k-anonymity range API with padding, so the password and its full hash never leave your browser. Nothing is stored.

How the private breach check works

  • Your browser turns the password into a 40-character SHA-1 hash.
  • Only the first 5 characters of that hash are sent to the Pwned Passwords service, with padding so the response size reveals nothing.
  • The service returns every hash ending that shares those 5 characters - usually several hundred.
  • Your browser looks for your full hash in that list and shows the count. The password never leaves the page.

What the result means

  • Found in breaches: attackers already have this exact password in their guessing lists. Change it everywhere you used it, starting with email and banking.
  • Not found: it is not in the known breach list, which is good but not proof of strength. Check the crack-time estimate too.
  • Weak or Fair score: the password is short or follows a pattern attackers try early. Replace it with a passphrase.

What makes a password strong in 2026

Current guidance such as NIST SP 800-63B favours length over forced complexity: at least 15 characters for passwords used alone, no forced periodic changes, and screening against breached-password lists - exactly the check above. A random passphrase of five or more words, kept in a password manager and protected by two-factor authentication, beats any clever substitution scheme.

Has my password been leaked?: questions and answers

Is it safe to check my real password here?

Yes, by design. The password is hashed in your browser and only a 5-character prefix of the hash is sent, which matches hundreds of different passwords. Nothing is logged or stored by AltFTool.

My password was found in breaches. Was my account hacked?

Not necessarily. It means someone, somewhere, used the same password and it leaked. Attackers try these leaked passwords on every site, so change it now and turn on two-factor authentication.

Can I check my email address for breaches here?

No. Email lookups need an account-linked API, so use haveibeenpwned.com directly. This tool only checks passwords, privately.

How is the crack time calculated?

From the estimated entropy after removing credit for common patterns, divided by realistic guessing speeds: 100 per hour online with rate limits up to 10 billion per second offline against a fast hash. It is an estimate, not a promise.

How often should I change my password?

Only when there is a reason: it appears in a breach, you reused it, or you suspect someone knows it. Forced regular changes tend to produce weaker, predictable passwords.

Security checks and guides

Full security check-upAll six tools, the tool directory and how each check works.Passphrase generatorGenerate random passphrases and passwords with your browser's secure random number generator. See the entropy of each one. Free, offline-capable, nothing stored.Phishing link checkerCheck a suspicious link for phishing tricks before you click: lookalike domains, fake bank and UPI links, punycode, hidden redirects. The link is never opened.Website security checkTest any website's security headers (HSTS, CSP, X-Frame-Options, cookies and more), get a grade and copy the exact fix. Plus a private page code audit.Personal security checkupTake a free 24-point personal security checkup covering passwords, 2FA, devices, scams, privacy and home Wi-Fi. Get a score and your highest-impact next step.Hacked account recoveryYour email, Instagram, WhatsApp or bank account was hacked? Follow these recovery steps in order, secure your email first, and know where to report fraud in India.Data breach responseGot a data breach email or saw your service in the news? Find out what was exposed, which passwords to change, and how to avoid follow-up scams.

88 more free security and privacy tools

Focused tools for one job each, grouped by what you are trying to do. All run in your browser unless the tool says otherwise.

Passwords and sign-in

Create, test and manage the credentials that guard everything else.

Scams and phishing

Spot tricks in messages, links, QR codes and calls before they cost you.

When something goes wrong

Step-by-step help after a hack, a breach, a lost phone or a card fraud.

Devices and home network

Harden phones, computers, routers and smart devices.

See all 88 tools

AltFTool stores no passwords, links or results. Only the website check uses AltFTool's server, to read headers, and it keeps nothing.