ChistStudioHow k-anonymity protects your password here
Your password never leaves your browser as plain text. It is hashed locally with SHA-1, and only the first five characters of that hash are sent to the Have I Been Pwned API. That prefix matches thousands of unrelated hashes, so the service has no way to know which specific password you checked — the actual comparison against the full hash happens locally, in your browser.
Strength score vs breach check — different questions
The strength bar estimates how hard a password would be to guess or brute-force based on length and character variety. The breach check answers a completely different question: has this exact password already appeared in a known data breach, regardless of how "strong" it looks. A long, complex password that has been breached is worse than a shorter one that hasn't.
Frequently asked questions
How does the breach check work without sending my password?
The password is SHA-1 hashed locally. Only the first 5 characters of the hash are sent to the API, which returns all matching hash suffixes; the final comparison happens in your browser. This is k-anonymity.
What makes a password strong?
Length matters more than complexity. A unique password per site, ideally generated and stored by a password manager, matters more than any single strength score.
What should I do if my password is found in a breach?
Stop using it anywhere immediately and change it everywhere it was reused, prioritizing email and financial accounts. Treat it as permanently compromised.