Occasionally, you download a list of hash prefixes. This local database is used to do a probabilistic match as to whether it might be a malicious website. If i

Occasionally, you download a list of hash prefixes. This local database is used to do a probabilistic match as to whether it might be a malicious website. If it might be, you send that hash prefix to Google, who respond with a list of full hashes with that prefix, and then you can go through that list (locally) and determine whether the computed hash is in the malicious set or not (without false positives). The important point is that the full hash is never sent over the wire from the end user: only a prefix (typically four ASCII-encoded hex bytes) is ever transmitted.