How your password stays private
This uses the k-anonymity method of the Pwned Passwords service. Your browser computes the SHA-1 hash of the password locally and sends only its first five characters. The service returns every known hash that starts with those five characters (hundreds of them), and your browser looks for a full match on its own. The password and the full hash never leave your device.
What a hit means
If a password appears, it has been seen in breaches and attackers include it in guessing lists, however complex it looks. Even a single appearance is a reason to retire it.
What a miss does not mean
It does not mean the password is safe. A short or predictable password can be absent from the list and still be weak. Prefer long random passphrases and a password manager.
Data from Have I Been Pwned: Pwned Passwords, licensed under CC BY 4.0. To make a strong one, use our passphrase generator.