Check if a password has appeared in a known data breach. Your password is hashed locally — only 5 characters of that hash are ever sent, never enough to identify it.
Your password is never sent to our serversHow it works: your password is hashed with SHA-1 in your browser. Only the first 5 characters of that hash are sent to the breach database (k-anonymity) — never your actual password, and never the full hash.
Checking a password against a breach database usually means trusting a third party with that password — a risky proposition. K-anonymity solves this: your password is hashed locally using SHA-1, and only the first 5 characters of that 40-character hash are sent to the server. The server responds with every breached hash that shares that same 5-character prefix — often hundreds of them — and your browser checks locally whether your full hash is among them. The server never learns your password, never learns your full hash, and can't distinguish your request from hundreds of others sharing the same prefix. This is the same technique used by password managers and browser built-in breach checks. If your password has been breached, change it immediately, especially anywhere else you've reused it.