Typing a password into a website to ask whether it is safe sounds like the worst idea in security. It would be, if the password were sent. It is not. Your browser hashes it, sends the first five characters of that hash to Have I Been Pwned, and compares the answer here — so the service learns a bucket of roughly two thousand hashes and cannot tell which one you asked about. Below: how that works, and why you should still be sceptical of any page asking for a password.
How k-anonymity makes this safe
The method is called a k-anonymity range query, and it works like this:
Your browser computes the SHA-1 hash of the password. For password that is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. Only the first five characters — 5BAA6 — are sent. Have I Been Pwned replies with every hash suffix it holds beginning with that prefix — around two thousand of them — along with how many times each has appeared in a breach. Your browser looks for its own suffix in that list.
The service therefore sees a request for a bucket containing thousands of different passwords, with no way to know which one interested you — and no way to reverse any of them, because it only ever held hashes. Nothing is sent to this site at all: the request goes from your browser straight to their API.
Why the response is padded
There is a subtler leak that the prefix trick alone does not close. If responses vary in size, someone watching your encrypted traffic can learn something from how many bytes came back, even without reading them. The request asks for padding, which adds decoy entries with a count of zero so responses are a similar size regardless of the answer. Those decoys are discarded here before anything is matched, so they cannot produce a false result.
What "not found" does not mean
A password absent from the database has not been shown to be safe. It has only failed to appear in the breach corpora one organisation happens to hold. Breaches go unpublished for years. A password can also be catastrophically weak and still be absent — pick something nobody has used before and it will not be in any list, which tells you nothing about how quickly it could be guessed.
Length and uniqueness decide your actual exposure, and neither is measurable here. A found result is strong evidence to change something. A not-found result is weak evidence of anything.
Should you type a password into a website at all?
Generally, no — and the instinct that made you hesitate is a good one worth keeping. What makes this case defensible is that the claim is verifiable rather than promised: open your browser's network tab and you will see exactly one outbound request, containing five hexadecimal characters. If a page asking for your password cannot be checked that way, do not use it.
If you would still rather not, the honest alternative is to skip the check and simply change any password you reuse. Reuse is the thing that turns someone else's breach into your problem, and it needs no tool to diagnose.
Related tools
For the rest of what your connection exposes: VPN leak test, tracking and cookie status, browser details, and the full connection report.
Privacy note
The password is held in the page's memory only for as long as it takes to hash it, and is never written to storage, never logged, and never sent to this site. The input is marked so password managers do not offer to save it. Closing or reloading the page discards everything.