Disposable email Tools
Updated 29 October 2026
Billions of stolen credentials circulate online. Type a password below to find out whether it is one of them. It never leaves your device: only 5 characters of its fingerprint are sent.
Your password is never sent. Your browser first turns it into a fingerprint, a 40-character string calculated with the SHA-1 algorithm. The same input always gives the same fingerprint, but you cannot work back from the fingerprint to the password.
The tool then sends only the first 5 characters of that fingerprint to Pwned Passwords, a service from Have I Been Pwned: a public database of passwords recovered from data breaches. The service replies with every known fingerprint that starts with those 5 characters, often more than a thousand of them. Your browser then looks for yours in that list, on your device.
This method is called k-anonymity: the service does not know which fingerprint in the list you care about, or even whether it is there at all. To blur the trail further, the tool asks for responses padded with fake entries, so that the size of the reply gives nothing away.
| Result | What it means | What to do |
|---|---|---|
| Found N times | This exact password appears in breaches, N times in total | Stop using it and change it everywhere |
| Not found, fair or strong | Absent from breach lists and hard to guess | Keep it for a single account |
| Not found, weak | Absent from breach lists, but easy to guess | Replace it with a longer password |
The number shows how many times this password has been seen across all breaches, not necessarily in one of your accounts. A password found only once may well have been used by someone else. It does not matter: once it is on those lists, attackers try it automatically on thousands of sites. It is burned.
Not appearing in a breach only proves that the password has not been published yet. A short or predictable password, such as a first name followed by a year, can be guessed in moments by software that tests millions of combinations.
That is why the tool also estimates strength, on your device, using simple criteria:
This estimate is only a guide. A password can look complex and still be tied to your personal life, so someone who knows you could guess it.
The easiest method to remember is the passphrase: four or five words picked at random, with no link between them, for example lamp-storm-violin-brick-salt. It is long, so very hard to guess, and much easier to remember than a jumble of symbols. Avoid quotes, song lyrics and proverbs, which are in attack dictionaries.
For the rest of your accounts, let a password manager generate random passwords of 16 characters or more. You will only need to remember the one for the manager.
No. It does not leave your device. Only the first 5 characters of its SHA-1 fingerprint are sent to the Have I Been Pwned service, which is not enough to recover it or to know which one you tested. Boxo receives nothing.
Not necessarily. The result means this exact password circulates in breaches, possibly used by someone else. But attackers will try it: change it everywhere you use it and turn on two-factor authentication.
Not necessarily. It only proves it has not been published. If it is short or predictable, software can guess it. Look at the strength estimate too and use at least 12 characters.
Here SHA-1 is not used to protect the password but to compare it with the Have I Been Pwned database, which is indexed that way. Since only 5 characters of the fingerprint are sent, its weaknesses have no effect on your privacy.