Compromised password
Check whether a password appears in a known data breach.
Has this password leaked?
Check whether a password you already use appears in a known data breach.
Your password never leaves this server: only five characters of its hash are queried.
How privacy is preserved
Your password is never transmitted. The server computes its SHA-1 hash and sends only the first five characters to the checking service, which returns several hundred hashes sharing that prefix. The comparison happens on your instance: the service cannot know which one concerned you.
Why this matters more than length
A password can be long and varied yet unusable: if it already appears in a breach, it is in attack dictionaries. Entropy measures resistance to exhaustive search, not to a ready-made list.