Breach Checker
Check if your credentials appeared in known data breaches using k-anonymity
Outcome
Check credential exposure using the safest available path, understand what the result means, and choose the next action without pasting unnecessary secrets.
Your progress
Mark each step as you complete it. This is saved only in this browser.
0 / 3 steps complete
Before you start
Visual frame
Review asset
Breach checker storyboard
Synthetic breach checker frame only. It uses fake credentials and avoids implying live breach confirmation or external exposure checks.
Synthetic frame
Checker input
Start with fake values.
Breach-check decision frame
A narrow credential-risk flow that checks only what is needed and routes exposed values to action.
Guided steps
Follow the task, then check the result.
Choose the smallest safe thing to check
Only check the value needed for the question. Do not paste a full document, log, or credential bundle when the tool only needs one value or one detection result.
Read the exposure result as a risk signal
A breach result means the value may need rotation, reset, or investigation. It does not prove who used it or whether the current account was compromised.
Act in the owning system
Use the account, provider, or key-management system that owns the credential to rotate, revoke, reset, or investigate. Redactorr can guide the check; it is not the system of record for the credential.
Branch questions
Did the check indicate the value may have appeared in a breach?
Is the raw credential still visible in content you plan to share?
Completion check
Support boundary
Support can use by default
- Value category such as email, password, token, or account identifier.
- Result state such as no match, match found, or unable to check.
- No raw credential value by default.
- Intent ID
- Article slug
- App route
- Browser and viewport
Requires your consent
- User-written description
- Email address
- Explicit attachment
- Redacted sample
- Support bundle previewed to the user
Not collected by default
- Raw original document text
- Full local file paths
- Pasted private content
- Unmasked screenshots
- Replay capture
Safe support summary
Copy a scrubbed handoff.
Redactorr KB support summary Article: /knowledge-base/breach-checker Selected issue: The checker result is unclear or does not match the value type you selected. Playbook progress: 0/3 steps marked complete Safe context to include: - Value category such as email, password, token, or account identifier. - Result state such as no match, match found, or unable to check. - No raw credential value by default. - Intent ID - Article slug - App route - Browser and viewport Requires explicit consent: - User-written description - Email address - Explicit attachment - Redacted sample - Support bundle previewed to the user Do not include by default: - Raw original document text - Full local file paths - Pasted private content - Unmasked screenshots - Replay capture User note: - Describe the step and symptom without pasting raw document text, secrets, files, or restoration material.
Article details
Breach Checker: A Background Check for Your Passwords
Ever wonder if your password was leaked in a data breach? That nagging feeling that maybe, just maybe, your credentials are floating around on the dark web?
That's what Breach Checker is for.
Think of it like a background check for your passwords. You paste in a password, email, or API key, and within seconds you'll know if it's been compromised in any of the thousands of known data breaches.
How It Works (The Privacy-First Way)
Here's the clever part: your actual password stays local during detection and redaction.
When you check a password, Redactorr uses a technique called "k-anonymity" that's used by security researchers worldwide. Instead of sending your password to a server (bad idea!), it only sends the first 5 characters of a cryptographic hash.
The server responds with all hashes that start with those 5 characters, and your browser compares them locally. It's like asking "do you have anyone whose name starts with 'Joh'?" instead of "do you have John Smith?"
The server never sees your actual password. Ever.
What You'll Learn
After checking a credential, you'll see:
- Breach Status: Whether it appeared in known breaches
- Breach Count: How many times it's been seen (higher = worse)
- What to Do: Clear steps to rotate/change the credential
Real-World Use Cases
Before sharing credentials with a new team member: Check if the shared password has been compromised before distributing it.
Auditing old API keys: That GitHub token from 2019? Check if it showed up in any leaks before deciding to rotate it.
Due diligence for compliance: Some security frameworks require proof that credentials haven't been breached. This gives you that proof.
Browser-Local Detection
This bears repeating: browser-local. The password you're checking is hashed in your browser using SHA-1, and only the first 5 characters of that hash are sent to HaveIBeenPwned's API.
Your actual password? Stays on your machine. Always.
Still stuck?
Copy a safe article handoff.
Start support with the article, the issue, and safe context. Raw document text, files, restoration material, and unredacted screenshots stay out unless you explicitly choose otherwise.
- Article slug
- Selected issue
- Screen name
- Action name
Redactorr support case Source: Article playbook: breach-checker Route: /knowledge-base/breach-checker Selected issue: The checker result is unclear or does not match the value type you selected. Safe context: - Value category such as email, password, token, or account identifier. - Result state such as no match, match found, or unable to check. - No raw credential value by default. - Article slug - Selected issue - Screen name or article section - Action name - Browser and viewport Only include with explicit consent: - User-written description - Email address - Explicit attachment - Redacted sample - Support bundle previewed to the user Do not include by default: - Raw original document text - Full local file paths - Pasted private content - Unmasked screenshots - Replay capture - Hidden diagnostic uploads User note: - Describe what you tried and what happened. Do not paste raw document text, secrets, files, restoration material, or unredacted screenshots.
Support case builder
One case format, wherever you start.
This is the same support case shape used by diagnostics and article handoffs.
- Value category such as email, password, token, or account identifier.
- Result state such as no match, match found, or unable to check.
- No raw credential value by default.
- Article slug
- Selected issue
- Screen name or article section
Private material belongs behind an explicit consent step, not in the initial case.
6 default exclusions