Common affectionate phrases
- Input
- iloveyou, teamo, meuamor
- Expected output
- Todas entre padrões amplamente reutilizados
A similar idea in any language tends to repeat the problem.
Carregando ferramenta… / Loading tool…
is the password "iloveyou" leaked
Short affectionate phrases like "iloveyou" feel personal, but millions of people land on the exact same choice. See the real breach-database result, computed in your browser.
A similar idea in any language tends to repeat the problem.
Public or guessable personal information is a separate risk.
The API returns every suffix starting with "EE8D8", roughly 1,900 lines, and the final comparison happens in your browser.
No. The full password never leaves your browser. It is turned into a SHA-1 hash locally, and only the first 5 characters of that hash (out of 40 total) are sent to the Have I Been Pwned API. It is mathematically impossible to reconstruct the original password from that prefix.
Because what feels unique to you (a term of endearment, a nickname) follows very common linguistic and cultural patterns, millions of people arrive at the same phrase independently, making it statistically predictable.
Length helps against pure brute force, but not against dictionary or breached-password attacks, if the whole phrase has already appeared in a previous breach (as is the case with "iloveyou"), its length stops mattering.
No. The k-anonymity mechanism guarantees only a 5-character hash prefix ever leaves the browser, never the password or the full hash, the same holds for any password you type into the full tool, not just this page's fixed example.
Yes, the Have I Been Pwned database aggregates breached passwords from services worldwide, so affectionate patterns in Portuguese, Spanish and other languages show up there under the same logic: any idea short and popular enough to be independently reinvented by many people becomes predictable.
The check uses Have I Been Pwned's Pwned Passwords database, with billions of passwords from real breaches. Your password is hashed right here in your browser, and only a small piece of the hash is ever queried.
The password is turned into a SHA-1 hash right on your device, using the browser's Web Crypto API. Only the first 5 characters of that hash (not the password, not the full hash) are sent to the API. The API returns every hash that starts with that prefix, and the comparison against the full hash happens locally, in your browser. This method is called k-anonymity and is the same one used by the official Have I Been Pwned website.
No password or full hash is ever sent, stored or logged by J-Kit. The lookup uses Have I Been Pwned's public Pwned Passwords API directly from your browser.