Email Breach Lookup
Check whether an email appears in public breach records.
Security checks for real accounts
Find exposure fast. Fix the accounts that matter.
Secure Dev Guy turns breach data, password hygiene, and recovery settings into practical next steps.
Free checks
Exposure tools
Password Safety Check
Check a password against Have I Been Pwned without sending the full password.
Open Checker
Uses SHA-1 prefix matching and compares the result in your browser.
Most people do not need a 60-page security program. They need a short list of accounts to fix first, a safer password workflow, and recovery settings that actually work when something goes wrong.
Account Hardening
Prioritize MFA, password manager adoption, recovery settings, and risky account cleanup.
Breach Response
Sort exposed accounts, rotate credentials, preserve access, and reduce repeat compromise risk.
Small Business Basics
Make practical controls repeatable across devices, cloud apps, domains, and email.
Common Questions
Does the password checker send my password anywhere?
No. Your browser hashes the password and sends only the first five SHA-1 hash characters to HIBP.
Why does the email checker use an API key?
HIBP requires an API key for email breach searches. The key stays in AWS Secrets Manager and is used by the Lambda endpoint.
What should I do if a breach is found?
Change the reused password, turn on MFA, review recovery email and phone settings, then check other accounts that used the same password.