Password Leak Check
Has my password been leaked? A private check against 900+ million breached passwords.
Uses the Pwned Passwords k-anonymity API: the browser hashes the password, sends only the first 5 hash characters and compares the answer locally. Users see exactly what was sent. A bulk mode checks up to 50 passwords with masked results for IT admins.
- Stage
- Live, free
- URL
- leakcheck.fullstackpartner.com
- Revenue
- Traffic and leads for the paid suite
- Price
- Free forever
- Audience
- Consumers after a breach headline, IT admins
- Stack
- Static HTML/JS · PHP 8.5 · nginx · Pwned Passwords API
The problem
- Leaked passwords are tried automatically on thousands of sites (credential stuffing).
- Users are rightly afraid to type their password into a website.
- Most people never check.
The product
A zero-server page: hashing and matching happen in the browser, the only request is the 5-character hash prefix with padding. A strength verdict and a link to the generator turn a bad result into a fix.
- Type the password.
- See if and how often it was leaked, and what left the browser.
- Change it everywhere and make a new one with the generator.
Who pays and why
Business model
| Revenue line | Price | Notes |
|---|---|---|
| Free | 0 kr | Single and bulk checks. |
| Team audit (planned) | Paid | Scheduled checks of a company's password policy and breach exposure inside the paid suite. |
Market and targets
Breach headlines create search spikes for 'has my password been leaked'. The privacy-first angle (what you send is shown live) is our differentiator.
The tools are free and stay free. Revenue comes from paid add-ons and from leads for the paid security suite. Targets are planning assumptions.
Go-to-market
Launch
- Live (done)
- Search Console
Content
- Pages per major breach
- Danish version
Channels
| Organic search | Breach-driven queries. |
|---|---|
| Generator cross link | Every strength check links here. |
Competition
| Alternative today | Why we win |
|---|---|
| haveibeenpwned.com | The source; we add strength, bulk and a cleaner flow. |
| Browser and password manager checks | Good, but only for passwords stored there. |
What we measure
- Checks per month
- Share of leaked results
- Generator clicks after a leaked result
Status and roadmap
- SHA-1 in the browser with Web Crypto, k-anonymity with Add-Padding
- Live display of the exact 5 characters sent
- Bulk mode for 50 passwords with masked results
- Own subdomain with Let's Encrypt, strict CSP, HSTS, no cookies, no analytics
- SEO: unique title, description, FAQPage and WebApplication schema, sitemap and Open Graph card per page
- Installable PWA with offline support
- Cross links between all five free tools and SiteSentry
- End-to-end browser test of every page and flow
- Danish version
- Email breach check with a paid HIBP key
Risks
| Risk | How we handle it |
|---|---|
| Third-party API dependency | Pwned Passwords is free, CDN cached and widely used; errors are shown clearly. |
Want a product like this?
We build version one of products like Password Leak Check from about $3,000: web app, admin panel, mobile app and API, live on your own domain. Then we can host and maintain it for $500 a month.