PUFFEN

Password Search

Check whether a password or an email address appears in a known breach.

🔑 Password check

🛡️ Your password is hashed in your browser with SHA-1. Only the first 5 characters of the hash are ever sent to the server (k-anonymity) — never the password itself.

📧 Email check

⚠️ Unlike the password check, this sends the email address to the third-party XposedOrNot breach API — there is no k-anonymity option. Only a SHA-256 hash of the email is stored on this server (for caching).

Dataset

Passwords: rot13.no / pwned-uio — a Have I Been Pwned-style list of ~5.1 billion leaked-password SHA-1 hashes. Emails: XposedOrNot.

How this works

🔑 Password check — fully private (k-anonymity)

  1. Your browser hashes the password with SHA-1 locally — a 40-character hex string.
  2. It sends only the first 5 characters of that hash to this server. Those 5 characters match thousands of different passwords, so the server can’t tell which one is yours.
  3. The server returns every leaked-hash ending that starts with those 5 characters (fetched from the pwned-uio dataset and cached in MySQL).
  4. Your browser looks for the rest of your hash in that list and shows the result.

The password and its full hash never leave your browser, and the server never downloads the full ~179 GB dataset — it fetches only the tiny slice each lookup needs, then caches it.

📧 Email check — via XposedOrNot

  1. The email address is sent to this server, which forwards it to the public XposedOrNot breach API.
  2. XposedOrNot returns which known breaches include that address, with details (year, records, exposed data types, risk score).
  3. This server caches the result keyed by a SHA-256 hash of the email — the plaintext address is never stored here.

⚠️ Unlike the password check, email lookups are not anonymous: the address must be sent to XposedOrNot for them to answer. Only check addresses you’re comfortable sharing with that service.