Check a Password Against a Breach List Without Sending the Password

As of October 8, 2026, it's possible to check whether a password has been compromised without sending the full password over the internet. This is achieved by hashing the password locally and transmitting only a portion of the hash. The browser performs the SHA-1 hashing and sends the first five characters of the resulting hash as a prefix to the Pwned Passwords range endpoint.

The server then responds with a list of suffixes that match this prefix, along with the number of occurrences for each suffix. The browser compares its own suffix against these candidates locally, without ever transmitting the remaining characters of the hash. This approach ensures that only a small amount of information is transmitted, reducing the risk of exposing the password itself.

The developers should implement this check after a user action, such as submitting a form, rather than on every keystroke to minimize network traffic and potential exposure. It's important to note that a zero match in the Pwned Passwords database does not guarantee that the password is strong or unique, as the dataset only indicates whether the password has been found in a known breach.

Additionally, the use of SHA-1 for hashing in this context is primarily for compatibility with the existing dataset and should not be used for secure password storage, as SHA-1 is considered unsuitable for that purpose. The provided JavaScript function demonstrates how to perform this local checking process.