Instead of sending your full password or even its full hash, this tool uses the k‑Anonymity model: we hash your password (SHA‑1), then send only the first 5 characters of that hash to the breach database. The database returns all hash suffixes that match that prefix. Your browser then checks locally if your full hash appears in the list. This way, no one — including us or the API — ever sees your actual password or its complete hash.

No. Your password stays inside your browser. The only external request contains an anonymous hash prefix that cannot be reversed to learn your password. Even if intercepted, it is useless without the full hash.

It means that your password has previously appeared in known data breaches. Attackers often compile these leaked passwords into lists used for credential stuffing attacks. If your password is pwned, you should change it immediately on all services where it is used.

It relies on the Have I Been Pwned password database, maintained by security expert Troy Hunt. The database aggregates hundreds of millions of passwords leaked in real breaches. However, a negative result does not guarantee your password has never been compromised — it simply means it was not found in the known corpus.

Yes, you can use the same k‑Anonymity API directly. Make a GET request to https://api.pwnedpasswords.com/range/{first5chars} and parse the plain-text response. Always hash your password client-side first.