Zero-Knowledge Architecture

Privacy & Password Data Protocol

PassCheck is built on one inviolable rule: your passwords and full cryptographic hashes must never leave your device.

No Backend Ingestion

All analysis, entropy computations, pattern matches, and score calculations execute entirely inside your local browser runtime.

Zero Storage

PassCheck does not write passwords to localStorage, sessionStorage, cookies, IndexedDB, or server databases. State exists solely in memory during your session.

k-Anonymity HIBP Lookups

Breach checks query Have I Been Pwned using only a 5-character SHA-1 prefix. Your full hash and cleartext password are never exposed.

Technical Privacy Verification

You do not have to take our word for it. You can inspect the privacy implementation directly:

  1. Open your browser's Developer Tools (F12 or Cmd+Option+I).
  2. Navigate to the Network tab.
  3. Enter any password into the analyzer. Notice that zero network requests are initiated during typing.
  4. Click "Check Breach DB". Inspect the single outgoing HTTP request.
  5. Confirm that the request URL is strictly https://api.pwnedpasswords.com/range/XXXXX where XXXXX is only 5 hexadecimal characters.
← Back to PassCheck Analyzer