It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. We do not store any of the submitted data. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. Many of the passwords we find on the web are not plaintext they are unsalted hashes of the passwords. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. To protect this data from eavesdropping, it is submitted over an SSL connection. Thus, it is necessary for us to submit a hashed version of your password to our server. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. This page, and indeed our entire business, exists to help make passwords more secure, not less. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites. If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. If you are not comfortable with this, do not enter your real password. We do not store your password or use it for any other purpose. Your password will be sent securely to the Enzoic servers to check if it is compromised.

Is my password compromised