you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 3 days ago

You don't send full raw hashes, k-anonymity is a thing. HaveIBeenPwned just takes the first 5 of a hash and sends you back a list that you compare clientside so it never leaves as a usable password.

  • source
  • parent