Privacy Policy

The password you type

PW Checkup checks password breach status entirely client-side, inside your browser. The password you enter is hashed locally using the Web Crypto API's SHA-1 implementation.

Only the first 5 hex characters of that hash are sent to the Have I Been Pwned Pwned Passwords API. The server returns a list of hundreds of hash suffixes that share that same prefix — it has no way of knowing which password (or even which full hash) you're actually checking. The comparison against your full hash happens locally, in your browser, after the response arrives.

In other words, your full password and full hash are never transmitted to, or stored by, any server in any form. We cannot see or know the password you enter.

Analytics

We may use privacy-respecting analytics to understand aggregate traffic patterns (e.g. which pages are visited, approximate country of origin). This data is anonymized/aggregated and is never linked to any password you enter or check.

Advertising

This site may display advertising served by Google AdSense. Google and its partners may use cookies or similar technologies to serve ads based on your prior visits to this or other websites. You can opt out of personalized advertising via Google's Ads Settings.

Cookies

This site itself does not set cookies for the password-check functionality. Third-party services we use (analytics, advertising, once enabled) may set their own cookies, governed by their own privacy policies.

Your rights

Depending on your location, you may have rights under regulations such as the GDPR or CCPA to access, correct, or delete personal data we hold about you. Since we don't collect personal data tied to your password checks, there's generally nothing of that nature to request. For questions, see our Contact page.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date.