bugatti.lolPassword check
Has this password already leaked?
Free, no account, no credits. The check runs entirely in your browser and the password is never sent anywhere.
Your browser hashes the password with SHA-1 and sends only the first five characters of that hash to Cloudflare's api.pwnedpasswords.com service. The remaining 35 characters never leave this page, and the comparison happens locally. Nothing is saved, no lookup is charged to your account, and we cannot recover your password afterwards because it was never sent.
What this can and cannot tell you
This answers one question: does this exact password already appear in published breach data? That is the single most useful thing to know about a password you are considering, because a breached password should never be reused regardless of how strong it looks.
A clean result is good but not conclusive. Absence from these lists does not make a password strong — it may simply not have appeared in a breach that has been catalogued yet, and it can still be guessed from a wordlist in seconds. Length and uniqueness matter more than any single check can tell you. A password manager generates something no list can contain.
If the password shows up as breached, change it everywhere you have used it, not only here. Reusing it across services is what turns one breach into several.
Where this differs from an identifier lookup
Looking up an email address answers a question about someone, and it is charged accordingly. Checking a password answers a question about your own credential, which is why it is free and works without signing in. What we will not do is display a plaintext password recovered from someone else's breach record — see the prohibited uses for why that is a line we hold rather than a feature we lack.