If you bcrypt it then the site could just keep the mapping of email to hash value. Then when you do a lookup, the site would know what email you tried. https:/

If you bcrypt it then the site could just keep the mapping of email to hash value. Then when you do a lookup, the site would know what email you tried. https://en.m.wikipedia.org/wiki/K-anonymity https://en.m.wikipedia.org/wiki/K-anonymity is likely a better approach to prevent that, which other similar sites like https://haveibeenpwned.com/ https://haveibeenpwned.com/ are already doing for the email addresses.