2.5: Check the Damage

Check the Damage

In Lesson 1.2 you learned that Have I Been Pwned keeps the public record of leaked passwords: hundreds of millions of them, collected from breach dumps. The lab below queries that record live. Time to find out where your old habits stood.

What to check, and what not to

Check the patterns you used to use: the old standby you just retired in 2.4, the family-pet-plus-year format, the word with a 1! that got you through 2012. Retired passwords and honest approximations of your old style are exactly what this panel is for.

Don’t type your new generated passwords here. Not because the check is unsafe — as you’ll see below, it’s designed so the password never leaves your browser — but because of the habit. Module 2 just spent four lessons breaking you of typing live passwords into web pages. The manager types them now; you don’t. Besides, a random 20-character password fresh from your generator has nothing to learn from a lookup. It can’t be in a breach that happened before it existed.

Use the “Has it leaked before?” panel. Try your retired standby. Try password123 for calibration. Try the pattern your family uses.

If your old password comes back found 40,000 times, take a moment with that number. Forty thousand accounts in breach dumps used your “personal” password, which means it has been in the standard cracking dictionary for years, and every stuffing run tries it early. It was never really yours. For a lot of people this is the moment the course clicks: the threat was never hypothetical, and the migration you did in 2.4 wasn’t caution. It was overdue.

If it comes back clean, good — just remember the record only holds known breaches. Clean and unique is safe. Clean but reused is a quiet time bomb.

How this check kept your secret

Here’s what happened under the hood: your password never left this page. Your browser computed the password’s hash (the one-way scramble from 1.2) locally, sent only the first five characters of it, and got back every leaked-password hash starting with those five characters — a few hundred of them. The matching happened on your machine. Have I Been Pwned never saw your password, its full hash, or even whether you got a hit. The technique is called k-anonymity: you hide in a crowd of hashes, and the server can’t tell which member of the crowd you asked about.

There’s a bigger lesson in that design, worth carrying beyond passwords. You just checked a secret against a database of 600+ million leaks while revealing essentially nothing. Privacy-preserving design exists, it’s practical, and it’s free — which means “we need all your data to provide the service” is a choice companies make, not a law of nature.

Module 2, done

Every account unique, generated, stored in an armored vault, autofilled by a tool that lookalike domains can’t fool, and now checked against the public record. That’s passwords handled, once and properly.

Module 3 takes on what passwords alone can’t survive: the day someone tricks you into handing one over. That’s where the second lock comes in, along with the thing that replaces passwords entirely.