Frequently asked questions
The short version: you can check if your password was leaked without ever sending it.
How do I check if my password was leaked?
Install Merlewatch, click the shield in your Chrome toolbar, paste or type the password and press Check. In about a second it tells you how many times that password appears in known data breaches (from Have I Been Pwned), or that it wasn’t found. It’s free.
Is it safe to type my real password into Merlewatch?
Yes, that’s what it is built for. Your password is turned into a SHA-1 hash on your own computer. Only the first 5 characters of that hash are sent to Have I Been Pwned, which sends back every leaked hash starting with those 5 characters (hundreds of them). Merlewatch compares them on your computer. Your password, and even its full hash, never leave your device. Nothing is saved, and the field clears itself after each check.
What is k-anonymity?
It’s the trick that keeps your password private. Because only a 5-character hash prefix is sent, and that prefix matches hundreds of different passwords, nobody watching (including Have I Been Pwned) can tell which password you checked.
Does Merlewatch store my passwords?
No. It never stores, logs or sends your passwords.
My password was found in a breach. What should I do?
Stop using it. Change it on every site where you used it, starting with email and banking. Use a different password for each site (the built-in generator helps), and turn on two-factor authentication where you can.
Can it check if my email address was in a breach?
Merlewatch has a “Check your email” button that opens haveibeenpwned.com, where you can check your email for free. We don’t build email scanning in, because it would mean sending your email address to a paid API.
Does it work on my phone?
No. Merlewatch is a Chrome extension for desktop computers (Windows, macOS, Linux and ChromeOS). On your phone you can send yourself the link and install it later on your computer.
Does Merlewatch use cookies or tracking?
No. The extension has no cookies, no analytics and no tracking. This website uses no cookies; it may use Cloudflare Web Analytics, which counts page views without cookies and without tracking you across sites.
Does Merlewatch cost anything?
No. Merlewatch is free, with no account, no ads and no in-app purchases.