How this stays private: Your password never leaves this browser tab, and it's never sent to rpmz.gr or anyone else. The password is hashed locally (SHA-1), and only the first 5 characters of that hash are sent to the HIBP API — a technique called k-anonymity. The API returns every breached hash sharing that prefix (hundreds of them), and the match is found locally in your browser. Nobody, not even HIBP, learns your password.