• ikidd@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    5
    ·
    15 hours ago

    You don’t send full raw hashes, k-anonymity is a thing. HaveIBeenPwned just takes the first 5 of a hash and sends you back a list that you compare clientside so it never leaves as a usable password.