That is the correct way of thinking, never trust anything with your passwords.
I was curious on what haveibeenpwned does, so I took a look at what the network tab in dev tools said what was actually sent. When I type a password (say password123) and press check it runs a function that hashes with the “SHA-1” hash function and then sends the first 5 characters of the result. The response is over a thousand lines in the format of
35 hash characters:number of breaches
If any of these hashes are the start of your original hash, you now know it’s exposed and how many times it’s been exposed.














It’s true, but I have A) family at home and B) the ability to (with the remote tools) stop prints, get screenshots at a consistent interval of time, and immediately get error messages. I accept the risks whenever I do decide to print unattended