Hacker News new | ask | show | jobs
by Yanu-3452 2190 days ago
You're confusing pwned passwords wtih https://haveibeenpwned.com/

As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes.

You then locally compare the complete hash to see if it is there.