How the breach check stays private
This tool checks a password against the Have I Been Pwned Pwned Passwords database using k-anonymity. Your browser hashes the password with SHA-1 and sends only the first 5 characters of the hash. The service returns every breached hash with that prefix and the match is made locally, so neither the password nor its full hash ever leaves your device.
Frequently asked questions
My password appears in breaches. What now?
Stop using it everywhere, change it on every account that used it, and switch to a unique generated password per site stored in a password manager. Enable two-factor authentication where possible.