Tidy My Mac
Free tool
Has my password been leaked? Check it, safely
Type a password to see whether it has appeared in a known data breach, and how long it would take to crack. The check runs in your browser: the password itself never leaves this page.
How your password stays private
Your browser turns the password into a SHA-1 hash, a 40-character fingerprint, and sends only its first 5 characters to Have I Been Pwned's Pwned Passwords service. The service answers with every leaked hash that starts the same way, several hundred of them, and your browser looks for a full match itself. Neither Have I Been Pwned nor we ever learn the password or its hash. The strength estimate is worked out on this page and nothing is sent for it.
What the strength estimate means
The time to crack assumes an attacker who has stolen a site's password database and tries ten billion guesses a second on their own hardware, the worst realistic case. Cracking tools don't try every combination in order: they start with leaked passwords, dictionary words, names and dates, and common substitutions like @ for a. So we score a password the way they would guess it, not just by its length.
If your password has leaked
- Change it on every site where you use it, starting with your email, Apple Account and bank.
- Use a different password for every site. The Passwords app on your Mac creates and remembers them, or use our password generator.
- Turn on two-factor authentication wherever it's offered, so a leaked password alone isn't enough.
- In the Passwords app, open Security to see which of your saved passwords are reused, weak or leaked.
Questions about checking a password
Only into one that never sends it. This checker works out the strength in your browser and checks leaks by k-anonymity, sending just 5 characters of the password's hash. If you're still uneasy, check a password you've stopped using, or change it afterwards.
Not necessarily. It means someone, somewhere, used the same password and it leaked; it may not have been you. But attackers try leaked passwords on every site, so stop using it anywhere.
Length and unpredictability. A random 16-character password, or four or five random words, is far stronger than a short word with symbols swapped in. And it must be unique: a strong password reused on a site that leaks is no longer strong.
Yes, for passwords saved in the Passwords app: open it and choose Security. Passwords you keep elsewhere, or type from memory, aren't checked.
More free security tools
Website scam checker
Type a site or paste a link: our scam and phishing lists, the domain's age and look-alike names.
Open the tool →Scam message checker
Paste an email, text or DM: the scam signs in it, and its links checked against our lists.
Open the tool →Password generator
Random passwords and passphrases, made in your browser with the length and characters you choose.
Open the tool →Email header analyzer
Paste an email's headers: SPF, DKIM and DMARC, the real sender, and where replies would go.
Open the tool →Mac app vulnerability checker
Is your version of Chrome, Firefox, VLC or another app safe? Known holes and the version that fixes them.
Open the tool →Report a harmful site
Found a phishing page, fake shop or scam site? Report it and we'll review it for our lists.
Open the tool →Has my Mac been hacked? How to check, and what to do
Phishing, malware or real access: the places to check, and what to do in each case.
Read the guide →How to remove malware from a Mac, step by step
The signs, the places malware hides, and what to do if a password stealer ran.
Read the guide →Stay protected with Tidy My Mac
Scan your Mac for malware, free for 7 days.
Just your email, no credit card. Then $19.99 for your first year, $59.99 a year after that.
Scan your Mac free