I mean, it does seem to do something. I generated a random one and it told me it was safe. For now! The box then told me to get a password manager with a link to its own password managers article and set up 2FA. The password manager list is just a collection of affiliate links with filler text btw.
If someone wants to figure out what the site sends to figure this stuff out and if it’s more than just rockyou.txt, go ahead.
F12 reports using that tool sends the password as a form body field to their site (which means their server can read the request in plain text), which responses a json with just a field of how many “matches”.
There’s no way to know whether they log the requests (so you should assume they do in uncertainty like this), but it certainly does the real thing of comparing it against a “leaked password” database in their servers. (If you want to check against these, there are real password dumps with list of leaked passwords you can ctrl+f yourself in your own PC, but even then they are likely not complete list as there still exist other database leaks of hashes where your password is not bruteforced yet to be put in plaintext but someone with more time might have gotten to it)
I mean, it does seem to do something. I generated a random one and it told me it was safe. For now! The box then told me to get a password manager with a link to its own password managers article and set up 2FA. The password manager list is just a collection of affiliate links with filler text btw.
If someone wants to figure out what the site sends to figure this stuff out and if it’s more than just rockyou.txt, go ahead.
F12 reports using that tool sends the password as a form body field to their site (which means their server can read the request in plain text), which responses a json with just a field of how many “matches”.
There’s no way to know whether they log the requests (so you should assume they do in uncertainty like this), but it certainly does the real thing of comparing it against a “leaked password” database in their servers. (If you want to check against these, there are real password dumps with list of leaked passwords you can ctrl+f yourself in your own PC, but even then they are likely not complete list as there still exist other database leaks of hashes where your password is not bruteforced yet to be put in plaintext but someone with more time might have gotten to it)