Billions of passwords from old breaches are freely available. If yours is among them, cracking takes seconds, the software simply walks down the list. This check tells you whether the password is in the Have I Been Pwned database, without sending the password anywhere.
The password never leaves your device. The browser computes a SHA-1 hash, sends the first five characters and receives a list of endings, the match is found locally. This is the standard Have I Been Pwned k-anonymity method.
The browser computes SHA-1 of the password and sends only the first five characters of the hash. The server returns every ending that starts with those five characters, hundreds of them. The match is found on your device, so the request cannot reveal which password was checked. The method is called k-anonymity.
It is how many records with that password were found across all breaches in the database. "Found 12,000 times" does not mean you were hacked: it means 12,000 other people invented the same password, and it has been sitting in cracking dictionaries for years.
The database only knows published breaches, a fresh hack nobody has reported yet is not in it. Being absent is not a certificate of safety: a long random password, different for every site, beats any check.
The other half is the channel. On open Wi-Fi it is visible where you go; 404 VPN encrypts the whole connection and keeps DNS inside the tunnel.
How to connect 404 VPN →Was this useful?
One tap, no sign-up