Check exposed passwords and email addresses.
No account required. Password exposure checks run with a prefix-only range lookup. Email lookups use a separate hash-range breach search when source access is configured.
Your browser hashes the password and compares the returned suffixes locally. Only the first five hash characters are sent for the range lookup; the password and full hash are not sent or stored.
Checking whether the breach-data source is configured.
When configured, your full address is sent to Caskveil over HTTPS, not to Have I Been Pwned. Caskveil lowercases and hashes it in memory; only the first six SHA-1 hash characters and standard request metadata, including Caskveil’s server IP, reach HIBP. Caskveil does not store the address, full hash, or result. HIBP’s public range omits sensitive and retired breaches.
To review a suspicious message instead, use the separate email phishing checker. It does not search breach data for an address.
Phone number
No lookup is performed. This check needs the breach-data assessment that specifies its privacy-preserving method.
Email matches come only from Have I Been Pwned’s public breach range data. Sensitive and retired breaches are excluded. A no-match result is not proof an address is safe. The password check remains a separate Pwned Passwords lookup, and the phishing checker reviews message content without searching breach data.
Have I Been Pwned data scope