Home

Ensuring the privacy of your passwords

Local SHA-1 hash generation:

• When you input your password in the app, a SHA-1 hash is generated locally on your device.

Enhanced privacy with k-anonymity:

• A k-anonymity model is used, so only the first 5 characters from the generated hash is sent to Have I Been Pwned?.
• This way, the site can't know which hash values are being queried, significantly enhancing privacy.

Hash list retrieval:

• HIBP receives the partial hash and provides a list of all hashes matching the first 5 characters.

Local hash comparison:

• The app then matches the remaining characters of the generated hash with the received results, locally on your device.
• Based on this, the app calculates and displays the results, indicating whether your password has been compromised in any known breaches.

---

  sequenceDiagram
    autonumber
    App->>App: Enter password
    App->>App: Generate SHA-1 hash
    App->>HIBP: First 5 characters of the generated hash
    activate HIBP
    HIBP-->>App: List of all hashes matching the first 5 characters
    deactivate HIBP
    App->>App: Match the remaining characters<br/>of the generated hash with the list
    App->>App: Display results

Loading