Yes, the server multiplies the query by the entire 8 GB every time. It’s not as slow as it sounds :-) … it’s basically limited by memory bandwidth. Yeah, we do

Yes, the server multiplies the query by the entire 8 GB every time. It’s not as slow as it sounds :-) … it’s basically limited by memory bandwidth. Yeah, we do return the full row. It does leak the hashes, but these are already public (you can directly download them from the Have I Been Pwned website). Under the hood, we don’t actually send the full hashes back; we can get away with just sending back fewer bits (enough to minimize the chance of a false positive).