Question 1

Is my password really never sent to a server?

Accepted Answer

Correct. Your browser hashes the password with SHA-1 locally, and only sends the first 5 characters of that hash to our server. The server returns hundreds of hashes sharing that prefix — it never learns your actual password or full hash. This is called "k-anonymity," and you can read the full mechanism in our guides.

Question 2

What database does this use?

Accepted Answer

We use the widely-trusted "Have I Been Pwned" Pwned Passwords database, built from billions of real breached passwords.

Question 3

If it says "safe," is my password 100% secure?

Accepted Answer

It means this password hasn't appeared in any breach known so far — not an absolute guarantee. It's still important to use a sufficiently complex password and avoid reusing it across sites.

Question 4

Is the password I typed stored anywhere afterward?

Accepted Answer

No. Once you leave or refresh the page, the password you typed is gone from browser memory. It's never stored anywhere, in any form.

Question 5

How is password strength calculated?

Accepted Answer

We use the widely-used zxcvbn algorithm, which analyzes length, character variety, and common patterns together. This calculation also happens 100% inside your browser.

FAQ