Is Anybody Using This Password?

Step 1. Hashing happens in your browser

The moment you submit a password, your browser converts it into a SHA-256 hash using the Web Crypto API. This is a one-way transformation, the hash cannot be reversed to recover your original password (without a lot of work). The raw password never leaves your device.

Here is the exact function that runs in your browser when you submit a password:

async function sha256Hex(input) {
  const encoded = new TextEncoder().encode(input);
  const buffer  = await crypto.subtle.digest("SHA-256", encoded);
  return Array.from(new Uint8Array(buffer))
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

Step 2. Only the hash is transmitted

The SHA-256 hash travels over HTTPS to our server. No plaintext password is ever sent, logged, or stored anywhere on our network. Even in the unlikely event of a network interception, the hash alone is useless without the original password.

Step 3. The hash is looked up in the database

Our database contains SHA-256 hashes of passwords that appear in publicly known data-breach collections and previously submitted passwords. We query whether your hash is present and return a count. The database stores only hashes. Never plaintext passwords.

A note on trust

You're taking our word that the page does what it says. If you're cautious (and you should be), you can view the full client-side source. I provide it unminified and readable. The hashing function above is sha256Hex() and is called immediately before any network request is made.

General reminder: Entering real passwords into random websites is a bad habit, even this one. Use a password manager and unique passwords for anything that actually matters!