> The answer is: use HIBP, or https://haveibeenpwned.com/ https://haveibeenpwned.com/. They’ve got the technical (and social) bits of this process right! While

> The answer is: use HIBP, or https://haveibeenpwned.com/ https://haveibeenpwned.com/. They’ve got the technical (and social) bits of this process right! While I'd trust HIBP more it isn't doing anything significantly different with the lookup process, is it? "There's no k-anonymity implementation for phone numbers at this point in time." https://www.troyhunt.com/the-facebook-phone-numbers-are-now-searchable-in-have-i-been-pwned/ https://www.troyhunt.com/the-facebook-phone-numbers-are-now-... Putting a number sends it directly in the GET request: https://haveibeenpwned.com/unifiedsearch/%2B1%20123%20456%20789 https://haveibeenpwned.com/unifiedsearch/%2B1%20123%20456%20... Edit: as does looking up an email. It's password lookups that use local hashing/k-anonymity: https://haveibeenpwned.com/Privacy https://haveibeenpwned.com/Privacy