Inside the breach signal: privacy-preserving password checks with HIBP

Veritus checks whether the password a user chose has appeared in a known data breach, without ever handling the password itself.

It uses the k-anonymity method against Have I Been Pwned, Troy Hunt's public database of roughly 12 billion compromised credentials. The password is hashed with SHA-1 and only the first five characters of that hash are sent; the plaintext password never leaves the browser or server and is never logged.

A previously breached password is a strong signal of credential-stuffing and mass account creation, and it surfaces as the reason code PASSWORD_BREACHED. Because the check is privacy-preserving by design, you get the fraud signal with none of the exposure of transmitting real passwords.