You could use the API directly instead of using the webpage. > GET https://api.pwnedpasswords.com/range/{first https://api.pwnedpasswords.com/range/{first 5 ha

You could use the API directly instead of using the webpage. > GET https://api.pwnedpasswords.com/range/{first https://api.pwnedpasswords.com/range/{first 5 hash chars} The service is only receiving the first 5 hash chars and thus could not collect your password. Or you could read the javascript code of the page when you visit it. > var i = sha1(n).toUpperCase(), > r = i.substring(0, 5); > $.get('https://api.pwnedpasswords.com/range/' https://api.pwnedpasswords.com/range/' + r).done(function (n) ... Or you could download the file and check it locally.