Have I been pwned? Turning breach data into a 10-minute response plan

Credential breaches aren't rare events anymore — they're the weather. Billions of email-and-password pairs are floating around in dumps like Collection #1, and attackers don't need to hack you if they can just log in as you with a password you reused in 2019.

So we added a Breach Check module. Two questions, answered honestly:

"Has this password been seen in a breach?"

We check it against the Have I Been Pwned Pwned Passwords corpus — and we do it *privately*. Your password never leaves our server in full. We hash it, send only the first five characters of that hash, and do the final comparison locally (a technique called k-anonymity). We never store or log it. If it shows up — and common passwords show up millions of times — you'll know instantly.

"Has this email been in a breach?"

We look the address up against known breaches and show you exactly which ones, when, and what was exposed — email addresses, passwords, locations, payment hints, whatever the breach leaked.

The part that matters: what next

Knowing you're exposed isn't the same as being safer. So our AI assistant turns the result into a short, prioritized plan:

• Rotate the affected passwords first, and anywhere you reused them.
• Turn on MFA — starting with your email account, because that's the master key to everything else.
• Assume the address is on phishing lists now, and treat unexpected "reset your password" emails with suspicion.
• If financial or identity data was in the breach, monitor statements and consider a freeze.

Ten minutes of focused action beats an afternoon of anxiety. The tool's job is to tell you which ten minutes.