Privacy isn't a feature. It's the foundation.

How LeakGuard checks a password without ever seeing it

This page describes exactly what LeakGuard sends over the network, and what it doesn't — no simplifications.

Example — what's sent for the password "correcthorse"
5CBE2C1A9F84E2B7D34F09A6...
■ Sent to Have I Been Pwned ■ Discarded — never transmitted
  1. You type a password into LeakGuard. Nothing is sent yet.
  2. A SHA-1 hash is computed on your device, using Apple's CryptoKit.
  3. Only the first 5 characters of that hash are sent over HTTPS to api.pwnedpasswords.com.
  4. The API responds with every known hash suffix that shares that 5-character prefix, along with how many times each has appeared in a breach.
  5. Your device compares the full hash against that list locally.
  6. Every non-matching line is discarded immediately. The result — safe, or compromised with an exposure count — never involves your plaintext password leaving your device.
✕

What never leaves your device

Your plaintext password. It is never transmitted, logged, or stored — not by LeakGuard, and not by Have I Been Pwned.

→

What is sent

A 5-character hash prefix, over direct HTTPS to Have I Been Pwned — not to LeakGuard's own servers. Requests include an Add-Padding: true header to reduce traffic analysis.

A note on email checks

Email breach monitoring works a little differently

Email checks route through a Cloudflare Worker proxy that LeakGuard controls. In Private Check mode, your email is hashed by that proxy before it reaches Have I Been Pwned — using the same k-anonymity approach as password checks, but via our proxy rather than directly from your device.

We're precise about this distinction on purpose: for password checks, your device talks to Have I Been Pwned directly. For email checks, our proxy is in the middle. Both are designed so your full email or password is never stored in plaintext — but the network path is different, and you deserve to know that.

What LeakGuard stores

Check history

Stored as a SHA-256 hash only, retained for 90 days. Your actual password is never part of that record.

Clipboard

Copied passwords are automatically cleared from your clipboard 60 seconds after copying.

Screen content

LeakGuard blurs itself in the app switcher so sensitive fields aren't visible outside the app.

Questions about how this works?

We'd rather over-explain this than have you take it on faith.

Email privacy@leakguard.app Read our security policy