For those worried about inputting a password into a tool like this, they've actually done a great job keeping your pass secure.

Passwords entered on this site do not get transmitted to the server. Instead, they are hashed, then only the first half of the hash is sent to the server. The server replies with a list of every password hash they've found in leaks that match the partial hash you sent them. Your computer then looks through the list and tells you if the password you entered (which was kept on your pc, not transmitted) exists in that list.

From Haveibeenpwneds perspective; they sent you a big list of potential matches, but don't know which one if any actually matches your password, because they were never given the full hash, let alone the raw password.

There's even an open-source script you can run that does this within a console instead of a browser. Or, you can download their whole password DB via their github tools, then check it entirely offline.

I don't know if I want to be putting my passwords in to something like this lol

PicardIsSexy - 0 times (!The_Picard_Maneuver@piefed.world you're safe. ;)

That was a close one!

For anyone reasonably concerned about the obvious boneheaded move of checking your email and then entering your password, here's some options:

• Don't check them at the same time or on the same device. Use wifi and a laptop to check your email. 20 minutes later on your phone and 5G, check your password. Two different IP addresses and browser fingerprints.

• Use Tor

• Change VPN locations and browsers on the same device.

• Don't just check your password and close the page. Check 10 made up BS passwords and throw yours in the middle.

This is all on top of the fact that HaveIBeenPwned has been a beacon of sanity for more then a decade. Troy Hunt remains huge in the cybersecurity research space, and diligently combs over data leaks. This site was one of Gizmodo's 100 sites that shaped the internet in 2018, and remains the most accessible database of leaked credentials there is, without actually giving away the credentials.

Now go check yourself before someone else wrecks yourself.

1234: 30,272,674 times

/headdesk

TIL that besides offering a password compromise checking service, they also offer a compromised email checking service!

I dont think its a good idea to give them your password

This functionality is built-in to bitwarden, they can safely check your entire vault for known breaches

They're missing a real opportunity here- when someone enters the "password" 12345, which 31,033,620 times by the way, their page should immediately display this