Repository navigation
Breach Check
Open the Generator tab and scroll to the Breach check section.
Type a password (or tap Use generator result) and tap Check. SecureVault uses the k-Anonymity method: the password is hashed with SHA-1 and only the first 5 characters of the hash are sent to the Pwned Passwords API. The full password never leaves your phone; the final match happens on the device. It is free and needs no API key.
Audit: tap Check all saved passwords to find which stored accounts use a password that has appeared in a breach.
Type an email address and tap Check email. This uses the free XposedOrNot API — no API key required. Results show which services were breached, the year, and what kind of data was exposed.
- Change the password on that service right away.
- Never reuse the same password across services.
- Turn on two-step verification where available.
The breach check is the only feature that uses the internet, and only when you tap Check. Password checks send a partial hash (k-anonymity); the email check sends the email address to XposedOrNot.
Data sources: Have I Been Pwned (passwords) and XposedOrNot (email).