That interactive javascript checker on their site also uses that API, so in theory HIBP doesn't get sent a copy of your password. A couple of weeks ago I spun

That interactive javascript checker on their site also uses that API, so in theory HIBP doesn't get sent a copy of your password. A couple of weeks ago I spun up a little clone with slightly-simpler javascript, just in case HIBP starts serving malicious javascript: https://safepasswordchecker.hashbase.io/ https://safepasswordchecker.hashbase.io/ Feel free to download the site and javascript for a static copy. Or reuse or modify and reshare as you like, as long as you're not malicious. Edit: This site was made with Beaker Browser (https://beakerbrowser.com https://beakerbrowser.com), which is rad, and you should check it out. Feel free to download / fork this site.