Sending your password to a server to check if it has been breached sounds like a bad idea, and it would be, if that's what actually happened. The trick that makes it safe is called k-anonymity, and it's worth understanding because it's a rare example of a privacy feature that isn't a trade-off.
What actually gets sent
Your password is never transmitted, not even encrypted. Instead, your device hashes it locally with SHA-1, then sends only the first five characters of that hash - not the password, not the full hash, just a short prefix shared by, on average, hundreds of other unrelated passwords.
- The server has no idea which password you're checking - it only sees a five-character prefix
- It returns every known breached hash suffix that matches that prefix, often hundreds of them
- Your device compares the full hash locally and only then knows whether there's a match
- Nothing about your actual password, or even a reversible fingerprint of it, ever leaves your machine
Why the distinction matters
A well-designed check doesn't ask you to trust the service with your secret. It's built so the service never needs the secret to begin with.
This is the same principle behind a lot of good security design: minimize what has to be trusted, rather than promising to handle a bigger trust carefully. A service that could theoretically see your password, even briefly, is one breach away from that data walking out the door. A service architected so it structurally can't see it removes that risk instead of managing it.
MyDefense's password check works exactly this way, both at signup and from the dashboard - the check is advisory, never blocking, and your password stays on your device the entire time.