Ask the ledger. Do not become the ledger.

Have I Been Pwned knows about public dumps. PasswordSafely will not. A password is hashed here (SHA-1), and only the first five hex characters travel to HIBP’s range API. The rest of the hash never leaves the tab. We do not store email — a mailbox would be a master key of a different kind.

PWNED.PASS

Password · k-anonymity

Password to test

Prefix sent: —
Status: Idle
Seen in dumps: —

Idle. HIBP range API with Add-Padding. PasswordSafely never sees the secret.

PWNED.MAIL

Address · not stored

An always-on watchlist requires someone to hold the address. That someone is not us. Have I Been Pwned already runs Notify Me. A one-time lookup happens on their site, in their tab, under their policy.

Email (optional, for linking only)

One-time check Future alerts · HIBP

Leave the field empty and the buttons still take you to HIBP. Fill it and the one-time link opens their account search for that address. We do not submit it.