How does this work privately?
We use a concept called kAnonymity using the SHA1 hashing algorithm:
1. Your browser hashes your password locally using the Web Crypto API.
2. Only the first 5 characters of that hash are sent to the HaveIBeenPwned (HIBP) API.
3. The API returns a list of hundreds of leaked password hashes that start with those 5 characters.
4. Your browser checks if your full hash is in that list locally.
Result: You know if your password is leaked, but HIBP never saw your password.