How It Works

  1. 1

    Your password is hashed with SHA-1 in your browser.

  2. 2

    Only the first 5 characters of the hash are sent to the HIBP API.

  3. 3

    HIBP returns all matching hash suffixes — your full hash never leaves your browser.

Learn more about the k-anonymity model →