Cryptographic Protocol
How Password Breach Checking Works
Understanding how PassCheck utilizes k-anonymity to guarantee zero-knowledge credential validation without leaking cleartext passwords.
The 4-Step K-Anonymity Flow in PassCheck
Step 1: Local SHA-1 Computation
Password is hashed in browser memory. Example: 'password' becomes 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
Step 2: 5-Character Prefix Partition
Only the first 5 characters (5BAA6) are sent to the HIBP range API endpoint.
Step 3: Multi-Suffix Cluster Response
The server returns a list of hundreds of hash suffixes sharing those first 5 characters along with occurrence counts.
Step 4: Client-Side Suffix Verification
The browser checks if the remaining 35 characters (1E4C9B93F3F0682250B6CF8331B7EE68FD8) exist in that list.