Breach & password check
Two separate checks: a password check that runs entirely in your browser, and pointers to checking an email address without handing it to us.
Password check
Your password never leaves this browser. This uses the Have I Been Pwned Pwned Passwords k-anonymity API. Your password is hashed with SHA-1 locally, in your browser, using the Web Crypto API. Only the first 5 characters of that hash are sent to the API — never the password, and never the full hash. The API returns every known breached hash sharing that 5-character prefix (often hundreds of them), and the match against the remaining hash is done back here, locally. There is no way for the API, or for us, to reconstruct your password from a 5-character hash prefix. We never see the password either — this check does not touch our server at all.
Email exposure
We deliberately do not run an email-breach checker on this site — that would mean a form submitting your email address to our server, which is exactly the kind of data collection this section is trying to help you avoid. Instead, check it directly with the people who maintain the breach database:
Check an email address on haveibeenpwned.com →
Have I Been Pwned lets you search an email address against known breaches, and offers a free notification service that alerts you if the address turns up in a future breach.