this post was submitted on 17 Jun 2026
149 points (99.3% liked)
Privacy
49209 readers
566 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Honestly suspicious and makes me think the whole site is a trap
ah shit my password
I mean, it does seem to do something. I generated a random one and it told me it was safe. For now! The box then told me to get a password manager with a link to its own password managers article and set up 2FA. The password manager list is just a collection of affiliate links with filler text btw.
If someone wants to figure out what the site sends to figure this stuff out and if it's more than just rockyou.txt, go ahead.
F12 reports using that tool sends the password as a form body field to their site (which means their server can read the request in plain text), which responses a json with just a field of how many "matches".
There's no way to know whether they log the requests (so you should assume they do in uncertainty like this), but it certainly does the real thing of comparing it against a "leaked password" database in their servers. (If you want to check against these, there are real password dumps with list of leaked passwords you can ctrl+f yourself in your own PC, but even then they are likely not complete list as there still exist other database leaks of hashes where your password is not bruteforced yet to be put in plaintext but someone with more time might have gotten to it)
Ah, OK. I was hoping it would maybe do something clever like hash it and send a byte so the server can give it a small list of passwords to check locally but I guess they didn't bother…