Chrome extension · Free
Check if your password was leaked. Without sending it.
Merlewatch checks your password against hundreds of millions of leaked passwords from Have I Been Pwned. It’s hashed on your own computer, and only the first 5 characters of that hash are ever sent.
Want to see it now? Try the live demo ↓
Desktop Chrome only. Send yourself the link and open it on your computer.
Send yourself the link- No account
- No cookies or tracking
- Nothing saved
Never type a real password into a website, including this one. Real checks happen inside the extension, on your device.
How it works
Your password never leaves your computer
Merlewatch uses the same k-anonymity method as Have I Been Pwned’s own password checker. Here’s every step.
- On your device
You type a password
Into the extension, never into a website.
- On your device
It’s hashed
SHA-1 turns it into
5BAA61E4C9B93… - Sent
Only 5 characters leave
Just
5BAA6. Hundreds of passwords share it. - Have I Been Pwned
A list comes back
Every leaked hash starting
5BAA6, about a thousand of them. - On your device
Matched locally
Merlewatch looks for your full hash in that list.
- On your device
You get the answer
“Seen in 2,266,543 breaches” or “Not found”.
Never sent: your password, its full hash, or which password you checked. Not to us, not to Have I Been Pwned, not to anyone.
Live demo
Try it with sample passwords
Pick a sample to see what Merlewatch shows. There’s no box to type in on purpose: real passwords belong inside the extension, not on a website.
One of the most common passwords in the world.
Results for these samples were checked with the real Merlewatch code against Have I Been Pwned on 04/11/2026. The random passphrase is made fresh for each version of this page.
Password to check
Seen in 2,266,543 breaches
Strength: Very weak · crack time: less than a second
- This is a commonly used password.
- Make it at least 12 characters. Length matters more than symbols.
Free features
Everything you need, nothing you don’t
Leak check
See exactly how many times a password turns up in known breaches, or that it wasn’t found.
Strength meter
A crack-time estimate and plain-English tips, powered by zxcvbn, all on your device.
Password generator
Memorable passphrases or random 20 to 64 character passwords. The clipboard clears itself after 30 seconds.
Email check
One click opens Have I Been Pwned to check your email address there. Merlewatch never sees it.
Screenshots
The real extension
Trust
Exactly what leaves your computer
No cookies. No tracking.
What’s sent
- The first 5 characters of a SHA-1 hash, to Have I Been Pwned’s Pwned Passwords service, with padding so response sizes don’t give anything away.
- That’s it. No cookies, no account, no analytics in the extension.
What’s never sent
- Your password, or its full hash.
- Which password you checked, or whether it was found.
- Your email, browsing, or anything about you.
Breach data comes from Have I Been Pwned, run by security researcher Troy Hunt. Merlewatch isn’t affiliated with Have I Been Pwned or Google. Read the Privacy Policy.
FAQ
Common questions
How do I check if my password was leaked?
Install Merlewatch, click the shield in your Chrome toolbar, paste or type the password and press Check. In about a second it tells you how many times that password appears in known data breaches (from Have I Been Pwned), or that it wasn’t found. It’s free.
Is it safe to type my real password into Merlewatch?
Yes, that’s what it is built for. Your password is turned into a SHA-1 hash on your own computer. Only the first 5 characters of that hash are sent to Have I Been Pwned, which sends back every leaked hash starting with those 5 characters (hundreds of them). Merlewatch compares them on your computer. Your password, and even its full hash, never leave your device. Nothing is saved, and the field clears itself after each check.
What is k-anonymity?
It’s the trick that keeps your password private. Because only a 5-character hash prefix is sent, and that prefix matches hundreds of different passwords, nobody watching (including Have I Been Pwned) can tell which password you checked.
Does Merlewatch store my passwords?
No. It never stores, logs or sends your passwords.
Check your passwords the private way
Free. No account. Nothing saved.
Want to see it now? Try the live demo ↓
Desktop Chrome only. Send yourself the link and open it on your computer.
Send yourself the link