Billions of passwords from old breaches are freely available. If yours is among them, cracking takes seconds — the software simply walks down the list. This check tells you whether the password is in the Have I Been Pwned database, without sending the password anywhere.
The password never leaves your device. The browser computes a SHA-1 hash, sends the first five characters and receives a list of endings — the match is found locally. This is the standard Have I Been Pwned k-anonymity method.
The browser computes SHA-1 of the password and sends only the first five characters of the hash. The server returns every ending that starts with those five characters — hundreds of them. The match is found on your device, so the request cannot reveal which password was checked. The method is called k-anonymity.
It is how many records with that password were found across all breaches in the database. "Found 12,000 times" does not mean you were hacked: it means 12,000 other people invented the same password, and it has been sitting in cracking dictionaries for years.
The database only knows published breaches — a fresh hack nobody has reported yet is not in it. Being absent is not a certificate of safety: a long random password, different for every site, beats any check.
The other half is the channel. On open Wi-Fi it is visible where you go; 404 VPN encrypts the whole connection and keeps DNS inside the tunnel.
How to connect 404 VPN →