From memory their system works by a using a partial-hash, minimising the leak of the password. So for: * Password: trustno1 * Hash: 1234567890abcdefghij You s

From memory their system works by a using a partial-hash, minimising the leak of the password. So for: * Password: trustno1 * Hash: 1234567890abcdefghij You send to the api: * Hash: 12345 And it returns all hashes it knows of that start with 12345 along with a count of how many times each hashed password has been breached. You then compare that list to see if your full hash exists in there. If it exists - it's been breached. If not - you're clear.