BreachCheck — Pixelvault Labs

BreachCheck — has your password been breached?

Billions of passwords have leaked in data breaches. If yours is one of them, attackers can log in as you anywhere you reused it. BreachCheck tells you in one click — without ever exposing your password.

PRIVATE BY DESIGN (K-ANONYMITY)
Your password is hashed with SHA-1 on your device, and only the FIRST 5 characters of that hash are sent to the free HaveIBeenPwned Pwned Passwords API. The API returns ~800 candidate hashes; your device compares them locally and reports the result. The password — and even the full hash — never leaves your device. It is never stored, and the field is cleared after every check.

WHAT YOU GET
- One-click breach check against 15+ billion breached passwords
- Password generator: 12–32 characters, cryptographically random (crypto.getRandomValues), numbers/symbols toggles, click-to-copy
- Local strength meter: entropy-based, no libraries, no network
- Check history: date + outcome only (never the password), clearable

HONEST WORDING
"Not found" means no known breach contains the password — it is not a guarantee of safety. We never claim a password is "safe".

PERMISSIONS — MINIMAL
- storage: keeps your check history (outcome only) on your device.
- api.pwnedpasswords.com: the anonymous 5-character hash-prefix lookup.
No content scripts. No page access. No remote code. No accounts, no tracking, no analytics.

Free forever. Made by Pixelvault Labs.