This is not a bad rule in general, but it's reasonable to make an exception if you know you are connecting to a trustworthy site. Most people trust Troy's site

This is not a bad rule in general, but it's reasonable to make an exception if you know you are connecting to a trustworthy site. Most people trust Troy's site because he is a known figure in the security community, and is transparent about who he is and his goals for running it. https://haveibeenpwned.com/ https://haveibeenpwned.com/ That said, the domain name is (IMO) needlessly clever and does not help instill trust in folks who are not already familiar with it. I recommend it to friends and family, but I cringe a bit whenever I have to post that URL into an email to, say, my aunt who is a retired librarian.