How to know if your password was leaked, without revealing it

It sounds like a trick question: to check whether your password is in a breach, somebody would have to know it. It turns out they do not, and the method is rather elegant.

Start with the obvious: never type your password into a site that will not explain what it does with it. A box saying "check your password" and nothing else is, at best, a bad idea. What follows is the explanation you should demand from anyone, ourselves included.

First, what a fingerprint is

There is a mathematical procedure that turns any text into a fixed-length string of letters and numbers. The same text always gives the same string, and similar strings do not mean similar texts. We call it a fingerprint because it behaves like one: it identifies without describing.

The important part is that the operation runs one way. Going from text to fingerprint is easy; going back is not. That asymmetry is the basis of nearly everything below.

The trick: ask about a group, not about yourself

If your browser sent the whole fingerprint of your password, whoever received it would know exactly which one you asked about. They could keep it and, with a list of common passwords already worked out, find out what it was. So it is done differently.

1. The fingerprint is worked out on your device

   Your browser does the sum locally. Nothing has gone out to the network yet.

2. Only the first five characters are sent

   A fragment from the start of the fingerprint, and nothing else. It does not identify a password: it identifies an enormous neighbourhood holding hundreds of them.

3. The whole neighbourhood comes back

   The service replies with every leaked fingerprint beginning with those five characters, typically several hundred, along with how many times each one appeared.

4. The comparison happens inside your browser

   Your device looks through that list for the full fingerprint, which only it knows. Whoever answered never found out which one it was.

On this site that query goes straight from your browser to the password service. Our server takes no part in it, so it could not see even the fragment if it wanted to.

What the number means

The result is not a yes or no, it is a count: how many times that password appeared in known breaches. And it means something more uncomfortable than it first seems.

It does not mean your account leaked. It means that combination of characters is already on the lists used to attack accounts. If your password appears forty thousand times, it is not that forty thousand people robbed you: it is that forty thousand people chose the same thing you did, which is why it sits at the top of every list of attempts.

A leaked password is dangerous even if nobody knows it is yours. The usual attack does not guess: it takes passwords already known and tries them against millions of accounts until one opens.

If yours appears

Change it everywhere you use it, starting with your email. And choose the new one for length before strange symbols: three or four words that do not form a known phrase hold up better than P@ssw0rd! and are remembered without effort. If you reused it across several sites, that is the real work, and it is put in order of priority in what to do if your email was leaked.

If it does not appear

Good sign, but not a certificate. Not being on the known lists means exactly that: it is not on the known lists. A short, guessable password may never have leaked and still fall in a minute. The check looks at the past, not at quality.