You can inspect the traffic to the API, but it only sends a hash prefix and returns a list of all matching hashes (k-anonymity). The hard work is done in the cl

You can inspect the traffic to the API, but it only sends a hash prefix and returns a list of all matching hashes (k-anonymity). The hard work is done in the client, not the back-end. https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...