Is the password you use to log in to your router, email, or VPN already on a list of stolen passwords? Type it below: the check compares it against the hundreds of millions of passwords collected by Have I Been Pwned from data breaches in recent years. The check happens in your browser, and the password is sent neither to me nor to them.
Need a new password? Here is a strong one
Generated in your browser using the cryptographic random generator (crypto.getRandomValues): uppercase, lowercase, digits, and symbols, excluding characters that have special meaning in the RouterOS terminal ($ ? ; \ " '). It does not pass through any server.
Where do I keep it? Do not store it in plain text in an Excel sheet, Notepad, an email, or a sticky note: anyone who accesses your PC will find it immediately. Use a password manager, which keeps it encrypted and fills it in for you. A good, free, open-source option is Bitwarden: I am not affiliated with them, choose the one you prefer.
Data: Pwned Passwords of Have I Been Pwned (Troy Hunt), license CC BY 4.0. The service is theirs: I only wrote this page, which logs nothing.
Does the password leave my computer?
No. The browser converts the password into a fingerprint (SHA-1, 40 characters) and sends only the first 5 characters of that fingerprint to the service. Have I Been Pwned responds with all stolen fingerprints that start with those characters (usually a few hundred, plus some fake ones added intentionally so the response size remains constant), and the comparison is performed locally on your device. This system is called k-anonymity: from 5 characters, it is impossible to reverse-engineer either the password or the full fingerprint.
This page sends nothing to my server and logs nothing: not the password, not the fingerprint, and not the result. After the check, the input field is cleared. Below the result, you can see the 5 characters that were sent.
Why does this matter for a MikroTik router?
Attackers probing WinBox, SSH, API, or WebFig on an exposed router do not guess passwords: they brute-force them using these lists, starting with the most common ones. A password found in these archives is among the first to be tried, even if it seems unique to you. You see this daily in the Dojo map under siege: management ports are among the most targeted.
What do I do if it is compromised?
- Stop using it everywhere, and change it immediately on all services where it is used: router, email, VPN, external sites.
- Use a different password for each service, long and random: a password manager can generate and remember it for you.
- On the router, in addition to the password: use a user other than
admin, close management services to the Internet, and make them reachable only from the management network or via VPN. You can find all the steps in the howto Basic Hardening of a MikroTik Router.
What if it does not appear?
That is a good sign, but not a guarantee. A short or predictable password (a name, a date, the word “mikrotik” with a number at the end) can be guessed even if it has never been stolen. The check only tells you if it is already in the lists used by attackers.
Frequently asked questions
Who runs the service?
The database is Pwned Passwords by Have I Been Pwned, Troy Hunt’s project, also used by many password managers and online services. The data is published under a CC BY 4.0 license. I only wrote this page, which queries their service directly from your browser.
Can I check the password I actually use?
Yes, that is what it is for: only 5 characters of the fingerprint are sent to the service. If you prefer, check it and then change it anyway: a new, unique password is always the best choice.
Does the check tell me where my password was stolen?
No. The password archive is not linked to email addresses or names: it only indicates whether a password has appeared in a data breach and how many times. To check whether your email address is in a data breach, use the search on the Have I Been Pwned website.