Has your email or password already leaked?
Check your email against known breaches, and test a password without ever sending it to anyone. Everything runs in your browser. We store nothing.
What actually happens to what you type
- Runs entirely in your browser. There is no ShieldFive server in the loop and nothing is stored.
- Passwords are never transmitted — only a 5-character hash prefix is, using the k-anonymity model, so the lookup service never learns your password.
- The email check queries the XposedOrNot public breach corpus directly from your browser, and only after you tick the consent box; ShieldFive never receives your email.
Breach data from Have I Been Pwned (passwords) and XposedOrNot (email). ShieldFive is not affiliated with either service.
Questions
- Is this breach checker safe to use?
- Yes. It runs entirely in your browser. Your password is never sent anywhere — only the first five characters of its SHA-1 hash are, using the k-anonymity model, so no service ever sees the password. Your email is sent only to the XposedOrNot breach lookup, never to ShieldFive, and nothing is stored.
- What should I do if my email or password was found in a breach?
- Change the password on every account where you used it, and never reuse a breached password. Turn on two-factor authentication. Use a password manager to generate a unique password per site, and keep sensitive files in zero-knowledge storage so a future breach of any provider cannot expose them.
- Where does the breach data come from?
- Password checks use the Have I Been Pwned Pwned Passwords range API, which is free and privacy-preserving. Email checks query the XposedOrNot public breach corpus. ShieldFive does not run its own breach database and stores none of your input.
- Does ShieldFive store the email or password I check?
- No. There is no ShieldFive server involved in the check at all — the lookups happen directly from your browser to the breach services. We never receive, log, or store what you type.
- Is the breach checker free?
- Yes. It is completely free and needs no account or sign-up. The only limits are the fair-use rate limits of the underlying breach services, which reset after a short wait.
- How up to date is the breach data?
- The datasets are maintained by Have I Been Pwned and XposedOrNot and updated as new breaches are disclosed. A "not found" result reflects what is in those corpora today, not a guarantee that your data was never exposed — new breaches surface all the time.
- Why does it matter if my password appeared in a breach?
- Attackers take passwords leaked from one site and try them across others — a technique called credential stuffing. If a password you use has appeared in any breach, treat it as public: stop using it everywhere, switch to a unique password per account, and turn on two-factor authentication.
Found in a breach? Make the next leak harmless.
ShieldFive encrypts your files on your own device with post-quantum, zero-knowledge encryption. Even if our servers were stolen, your files stay sealed — because we only ever hold ciphertext.
Get 5 GB free
No credit card. Open-source cryptography.