Good resource for checking that your hashed passwords are not in the cloud

Hashes dot com will search various sites and find if the hash of your passwords is out there. Up to 25 searches is free. It can take a week or two.

I hash the password on my device to make sure I am not publishing it. The very first hash I posted was found and they emailed me the associated passphrase.

Now, I realise that MS and any reputable website will salt a password/pass phrase before hashing it, but I was surprised that they were able to find mine somewhere.

Here is a PS script, written by ChatGPT, to do the hash on your own computer so it can't escape into the wild. Just rename it to have the ps1 extension as I will not post an executable.

they do not 'crack' hashes, they just look in databases.

This site maintains a bunch of rainbow tables for cracking password hashes. There is no relation to whether or not your password is known on any service. As you stated most sites salt passwords.

This is a good resource

Some password managers have the ability to tell you if your password shows up in known breach lists. Have I been Pwned is a reliable source to determine if your email exists in a known breach. They will tell you which site so you can change your password.

neemobeer said:

Some password managers have the ability to tell you if your password shows up in known breach lists. Have I been Pwned is a reliable source to determine if your email exists in a known breach. They will tell you which site so you can change your password.

Click to expand...

Google password manager has a "password checkup function".

Bitwarden is also integrated with HaveIBeenPawned to check one password at a time, for free, or the entire password vault for paid accounts. The are using an API that doesn't pass passwords to HIBP.