Free Tool
Data Breach Explainer
How does a website check whether your email was in a data breach — without you having to trust it with your email? The answer is a clever trick called k-anonymity, and this page walks you through it with fictional sample data and mock screens. It is an explainer, not a checker: it never asks for your real email, and it never checks a real account.
This is not a breach checker — it never accepts a real email address. Every screen here is a labelled mock with fictional sample data. A live checker would need a paid service and your real email; this page teaches you how the trick works instead, so you understand what a real checker does with your data.
What this tool does
A data breach is when a service loses control of its users' data — names, email addresses, passwords — to an attacker, who then sells it, publishes it or uses it. The question everyone asks next is whether their own email was in the breach, and the honest way to answer it is a breach-checking service. The problem is trust: to check your email, the service would need your email, and sending your email to a stranger's website is exactly the kind of thing a security-conscious person avoids.
The solution is k-anonymity, and it is worth understanding because it is one of the cleverest privacy ideas on the web. Instead of sending your full email address, your browser hashes it — turns it into a fingerprint — and sends only the first five characters of that fingerprint to the service. The service replies with a list of all fingerprint endings that start with those five characters, a list of hundreds of possibilities. Your browser then checks, locally, whether your full fingerprint is in that list. The service never learns your email, and never even learns which fingerprint in the list is yours — because the list contains hundreds, and any one of them could be the query.
This explainer walks you through that process with fictional sample data and labelled mock screens, step by step. You will see the fictional email, its fingerprint, the five characters that are sent, and the list that comes back — and you will see why the service learns nothing useful. It is the honest alternative to a live checker: this site will not build a tool that takes your real email, because a live check would need a paid service and would ask you to trust a third party with your address — and the no-cost rule and the privacy rule both say no.
Try it
Walk through a breach check with fictional sample data. Nothing here is real — every screen is a labelled mock, and no email is ever entered or checked.
Mock screen — fictional sample data. Press a step button to walk through a breach check the way k-anonymity does it. No real email is involved at any point.
How it works
The trick has four steps. First, your browser takes the email address and hashes it with SHA-1, producing a 40-character fingerprint. Second, it sends only the first five characters of that fingerprint to the breach service — five characters out of forty. Third, the service returns every fingerprint in its database that starts with those five characters: because five hexadecimal characters have about a million possible values and the database holds hundreds of millions of entries, the reply contains hundreds of endings. Fourth, your browser checks locally whether your full fingerprint is among them, and tells you the answer. The service saw five characters and returned a crowd; it cannot tell which member of the crowd was yours.
That is k-anonymity: safety in a crowd of size k. Here the crowd is the hundreds of fingerprint endings that share a five-character prefix, and the guarantee is that the service's view of your query is no more specific than the crowd. It is the same idea behind the password leak checker in the password guide on this site, which uses the same five-character trick for passwords — and for the same reason: it checks a secret without revealing it.
The explainer's mock screens show each step with fictional data — a sample email address that is not a real person's, a fingerprint that is the real fingerprint of the word password (a textbook example, used here only as a visible fingerprint), and a list of endings that is invented for teaching. The mock is labelled at every step, because the point is to teach the mechanism honestly, not to pretend a check happened.
Limitations
This page is an explainer, not a checker. It never accepts a real email address, it never checks whether any real account was in a breach, and its screens are labelled mocks with fictional sample data. If you want a real check, use a reputable breach-checking service — and understand, from this page, what it does with the five characters it receives, and why a service that asks for your full email is asking for more than it needs.
- A breach check tells you whether an email appears in a known breach database. It cannot tell you about breaches that were never discovered, never disclosed, or never added to the database.
- A clean result does not mean your accounts are safe. Unique passwords and two-factor authentication are what protect you — a check only tells you about the past.
- The fictional fingerprint shown here (5BAA6…) is the well-known SHA-1 prefix of the password password, used as a textbook example. It is not anyone's email fingerprint, and it is not a real check result.
Examples
Example 1 — the fictional check. Walk the four steps with the sample data: a fictional email, its fingerprint, five characters sent, a list returned, and a local match. The service learns five characters of a fingerprint — and five characters, shared by hundreds of other fingerprints, identify nobody. That is the whole trick, and it is worth seeing once, slowly, rather than trusting a green tick on a website you cannot inspect.
Example 2 — what a real result means. Suppose a real checker says your email appears in two breaches. The action is not panic but order: change the password on every account that used the breached password, starting with your email; turn on two-factor authentication; watch for phishing that uses the breached data — because attackers use breached details to write convincing messages. The data-breach guide on this site gives the full post-breach plan.
Example 3 — what a clean result does not mean. A real checker says your email appears in no known breach. That is good news, but it is not a verdict: breaches that were never discovered or never disclosed are not in the database, and a password reused across accounts is still one breach away from every account that shares it. The habit that protects you is unique passwords and two-factor authentication, not a clean check.
Frequently asked questions
How does breach checking work without revealing my email?
Your browser hashes the email and sends only the first five characters of the fingerprint. The service returns every fingerprint ending with that prefix — hundreds of them — and your browser checks locally whether yours is among them. The service never learns your email, or even which fingerprint in the list was yours.
What is k-anonymity?
Safety in a crowd: a query is hidden among many similar ones, so the service cannot tell which one was yours. In breach checking, the crowd is the hundreds of fingerprint endings that share a five-character prefix.
Can I check my real email on this page?
No — deliberately. This page is an explainer with fictional sample data, not a checker. It never accepts a real email address. Use a reputable breach-checking service for a real check, and use this page to understand what it does with your data.
What should I do if my email was in a breach?
Change the password on every account that used the breached one, starting with your email; turn on two-factor authentication; and watch for phishing that uses the breached details. The data-breach guide on this site gives the full post-breach plan, step by step.
Does a clean breach check mean I am safe?
No. It means your email is not in a known breach database. Breaches that were never discovered or disclosed are not in the database, and a reused password is still a risk. Unique passwords and two-factor authentication are what protect you.