Has this password leaked?
Type a password in the app and get a yes or no on whether it appears in a known breach. Only a short hash prefix is sent; the password itself never is. Free with an account.
How the check works
- 01Your device hashes the password. A one-way hash; it cannot be turned back into the password.
- 02Only the first five characters are sent. Thousands of leaked hashes share that prefix.
- 03Your device compares the rest locally. A match means the password is in a known leak list.
- 04You see yes or no, and what to do. Change it where you reuse it; turn on two-step sign-in.
The short answer
Updated 23 October 2026 · Reviewed by the Sigrel team, Texas
You can check a password against known leaks without revealing it. The method is called k-anonymity: the device sends a short prefix of the password’s hash, receives every leaked hash with that prefix, and does the comparison itself. A leaked result does not mean your account was hacked; it means that password is in a list attackers try everywhere, so change it wherever you reuse it and turn on two-step sign-in.
Behind every scan
What is checked, how often, and what you get back. The details, in plain words.
Sources
3 breach-intelligence partners and public leak lists
Each one named in Help with what it covers.
What we watch
6 kinds of identifier
Email, phone, username, gaming handle, email alias and your own domain. Hashed on your device first.
Schedule
Rechecked on a schedule you can see
Every result shows when it last ran. Daily on Pro.
What you get
A fix for every finding
The minutes it takes and the points it gets back. Broker removal across 200+ sites on Pro.
How Sigrel helps
From a leaked password to a fixed account.
Password check
Yes or no, without the password leaving your device. In the app, free.
Which breach paired it with your email
A password with your email beside it is the critical kind. Sigrel shows which breach, and the fix.
Two-step sign-in, in minutes
The Security checkup walks through it per account, with the time it takes.
Why it matters
Leaked passwords are tried everywhere.
Sources named and dated.
CISA · guidance
Unique passwords and two-step sign-in
Government guidance is consistent: a unique password per site and two-step sign-in stop the attack that follows a leak.
Source ↗Sigrel · method
k-anonymity, the same protocol password managers use
How the check works, and what the server does and does not receive.
Source ↗Questions
Plain answers.
How can you check a password without seeing it?
Your device hashes the password and sends only the first five characters of the hash. The server returns every leaked hash that starts with those characters, and your device checks the full hash locally. The password, and its full hash, never leave the device. Password managers use the same method.
My password is in a breach. What now?
Change it on every site where you used it, starting with your email account, then turn on two-step sign-in. The playbook has the order.
Does a “leaked” result mean my account was hacked?
No. It means that password appears in a known leak list, from your account or someone else’s. Attackers try leaked passwords everywhere, which is why reuse is the risk.
Can Sigrel tell me which site leaked it?
Not from the password alone. The breach view does that for your email: which breaches include it and what leaked in each.
Why do I need an account for this?
The checker runs inside the app with your identifiers’ breach view next to it, so a leaked result leads straight to the fix. The account is free.
Check a password without sending it.
Free account; the password never leaves your device.