Am I Pwned?

Warns you when a password you enter appears in a known data breach (Have I Been Pwned), without ever sending it.

Am I Pwned? warns you when a password you enter has already appeared in a known data breach, so you can choose another one before it's too late. Your password is never sent anywhere. HOW IT WORKS - Type a password in any password field: login, sign-up or "change password" forms, on any website. - When you leave the field (or press Enter), the extension checks the value once. - A small badge appears under the field: ⚠ Compromised password (seen 3.7M times): the password was found in breaches. Hover over the badge for the exact count. ✓ Not found in known breaches: no known breach contains this password. Check unavailable: the breach database could not be reached. Nothing is checked while you type. Editing the value just hides the badge until you leave the field again. YOUR PASSWORD STAYS ON YOUR DEVICE The extension uses the k-anonymity model of the Pwned Passwords service from Have I Been Pwned: 1. The password is hashed (SHA-1) locally, inside the page. 2. Only the first 5 characters of that hash are sent to api.pwnedpasswords.com. Hundreds of thousands of different passwords share any given 5-character prefix. 3. The service returns every known hash starting with that prefix, and the extension compares them with yours locally. 4. Requests use padding, so the response size reveals nothing either. Neither your password nor its full hash ever leaves the page. Why only when you leave the field? Checking on every keystroke would send the prefix of "passw", then "passwo", then "passwor"… and that sequence would let someone who sees the requests rebuild the password. Checking only the final value keeps k-anonymity intact. PRIVACY - No account, no sign-up, no API key. - No analytics, no tracking, no ads. - Nothing is stored: no history of checked passwords or visited sites. - The only network request goes to api.pwnedpasswords.com, and it contains only a 5-character hash prefix. WHY "READ AND CHANGE ALL YOUR DATA ON ALL WEBSITES"? Chrome shows this warning because the extension has to detect password fields on every site you visit. It only reacts to password fields (<input type="password">) and only adds the badge under them. It does not read or change anything else on the page. GOOD TO KNOW - Works on single-page apps, inside iframes and inside open shadow DOM. - Inactive on plain http:// pages: browsers don't provide secure hashing there, and the extension won't send your password out of the page to hash it. - Open source: https://github.com/ismail1432/amipwned Breach data: Have I Been Pwned (haveibeenpwned.com) by Troy Hunt, Pwned Passwords data under CC BY 4.0. This extension is an independent project, not affiliated with Have I Been Pwned.