HIBP K-Anonymity Format
Explains the Have I Been Pwned k-anonymity flow: SHA-1 password, first 5 chars on GET, suffix returned.
O cálculo é 100% local no seu navegador (SHA-1 via Web Crypto) — nada é enviado.
Copiado!
O serviço Pwned Passwords usa k-anonymity para nunca receber a senha completa.
- Compute o SHA-1 da senha em maiúsculas hex (40 chars)
- Envie um
GET https://api.pwnedpasswords.com/range/<PRIMEIROS_5> - O servidor responde com lista de sufixos (35 chars) + contagem
- Procure seu sufixo nessa lista localmente
Assim, o servidor nunca recebe a senha nem o hash completo.
How HIBP checks a password without reading it
You want to know whether a password shows up in known breaches, but handing the whole password to someone else's server feels wrong. The Have I Been Pwned k-anonymity protocol solves that, and this page walks the exact request with your own input: type a password and watch the hash split into the part that leaves and the part that stays.
The flow has four steps. Compute the password's SHA-1 as 40 uppercase hex characters. Send a GET to api.pwnedpasswords.com/range/ followed by the first five characters. The server answers with hundreds of 35-character suffixes, each with an occurrence count. You then search for your suffix in that list, on your own machine. The SHA-1 here is computed by the browser's Web Crypto API.
One thing to be clear about: this page never calls the API. It formats and explains the request, and gives you a button to copy the finished URL — running the GET and grepping for your suffix is your job, in a terminal or in your code. The password field is a plain text input with no masking, so mind shoulder surfers and screen recordings. If the password is real and in use, rotate it after testing anyway.
Frequently asked questions
Does this tell me if my password was breached?
Does my password leave the browser?
Why SHA-1 instead of SHA-256?
Related Tools
Bcrypt Hash Generator
Generate secure bcrypt hashes from passwords and verify whether a password matches an existing bcrypt hash.
Password Crack Time Estimator
Estimates brute-force cracking time for a password in three scenarios (online, offline and GPU), from its length and character set. It does not check any leaked-password dictionary.
Passphrase Generator
Generate strong, memorable passphrases made of random words. Easy to remember and hard to guess.
Password Policy Batch Auditor
Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.
Common Password Blacklist Check
Checks a password against the top 1000 most-used passwords, fully client-side, and flags it as compromised.
Password Strength Checker
Analyze the strength of any password: length, character classes, entropy in bits and resistance estimate. Processed in the browser — the password never leaves your device.