you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 month ago

You don't send full raw hashes, k-anonymity is a thing. HaveIBeenPwned just takes the first 5 of a hash and sends you back a list that you compare clientside so it never leaves as a usable password.

  • source
  • parent