How Have I Been Pwned Works — and Why k-Anonymity Matters

How Have I Been Pwned Works — and Why k-Anonymity Matters

HaveIBeenPwned lets you check if your password appears in a breach without ever transmitting your password. Here is the k-anonymity model that makes it safe.

This guide covers the key concepts, practical steps, and common mistakes to avoid when addressing this aspect of password security.

Best practices

• Use a dedicated password manager for all credentials
• Enable multi-factor authentication wherever supported
• Use unique passwords for every account
• Regularly audit accounts for breached credentials
• Generate passwords with a cryptographically random generator like PassGeni

How PassGeni helps

PassGeni addresses this challenge directly through its AI-seeded generation engine. Passwords are created client-side using JavaScript's crypto.getRandomValues() API — no data ever leaves your browser.

The Password DNA Score provides a 7-point quality audit so you know exactly how strong each generated password is before you use it.