Start with what
you know.

This one is real. Your address is sent to Have I Been Pwned to check it against public breach lists, and then it is gone from our side. We do not save it, log it or email you. Breach list from Have I Been Pwned, used under CC BY 4.0.

Before you type: a fake site can copy this idea to steal passwords. You never have to type a password into any website to check it. Your password manager (Google Password Manager, iCloud Keychain, 1Password, Bitwarden and others) can check your saved passwords against known leaks without you typing them anywhere. If you use our box, here is exactly what happens: your browser scrambles the password into a long code and sends only the first 5 characters of that code to Have I Been Pwned. Hundreds of known leaked passwords, and countless others, start with those same 5 characters, so the 5 characters alone do not tell them which one you typed. Your browser looks for yours here, on your device. Am I Hacked never sees your password. It is not saved by this page and not sent to us. Have I Been Pwned sees only those 5 characters and your internet address, like any website you visit. If your browser offers to save the password, say no.