Password monitor

How it works

A leak is a dump of credentials from some other site or service that was broken into or left exposed. A monitor compares a password, or a fingerprint of that password, with those dumps. If there is a match, that password is already in someone else’s notes. If there is no match, the tool did not find it in the dumps it holds. That is not a certificate of secrecy. It is a search of a particular haystack.

A careful monitor never needs the clear password to travel as a whole. The usual safe pattern hashes the password on the device, sends only a short prefix of that hash, and checks the rest of the match locally against the small list that comes back. You should see that pattern, or an equivalent that keeps the secret on your side, before you paste a live password into a page you do not trust. A form that asks for the password and your email together, then stores both, is not a monitor. It is a new place that password can leak from.

Some monitors watch addresses, not passwords: they tell you that an email appeared in a dump, with or without the password field. That is a different question. “This address was in a breach” does not always mean “this exact password is in the dump in front of you.” Read which check you ran. Mixing the two is how people change the wrong secret and leave the right one sitting in a stolen file.

A password monitor is a smoke alarm for old fires. It cannot tell you that nobody will ever strike a match.

What a match means, and what it does not

A match means that string, or a close stored form of it, is already public to attackers who collect dumps. Stop using it on every account that still has it. A unique password that existed only on the broken site is still burned for that site. A password you reused is burned everywhere you reused it. Reuse is how one dump becomes many logins.

A monitor does not log you out of anything. It does not reset the other site. It does not talk to your bank. After a hit, you change the password on each place that shared it, starting with mail and money, and you turn on a second factor where the service offers one. The monitor’s job ended at the warning. The work is the change.

Check the password, or the address, with a tool that does not keep the secret. If it hits, treat that string as public. Do not edit it by one character and reuse it. Change each account that used it, mail and finance first.

Store a new unique password in a manager you actually use, not in a browser you share. Run the monitor again only on the new string if you want a second look; the old string will keep matching forever.

No match is not a blessing on a weak password. A short, guessable word can be absent from a dump and still be easy to try. The monitor answers “have we seen this exact secret in a known leak?” It does not answer “is this hard to guess?” Length, uniqueness, and a manager answer the second question. The first question is still worth asking, because dumps are how mass login attempts get their word lists.

What not to paste

Do not paste a password into a page you opened from a random advertisement. Do not paste the same password into three “checker” sites for a second opinion; you just multiplied the places that saw it. Do not paste a one-time code, a recovery key, or a bank PIN into a monitor. Those are not password-dump questions.

Do not use a live production password as a demo for a friend. Type a dummy string if you are showing the screen. If you need to test the tool, use a string you have already retired, not the key to your mail. Treat the dump search as one layer next to unique passwords and a second factor, not as a substitute for either.