How this stays private: the breach check hashes your password locally with SHA-1, then sends only the first 5 characters of that hash to the Have I Been Pwned API. The API returns every breached hash that starts with those 5 characters, often thousands of them, and the match is confirmed locally in your browser. Your password, and even your full hash, never leaves this page.