Knowing that a password or an address has leaked is useful. Typing it into a website to find out is dangerous. ThetaSecurity OS checks credentials against dark-web breach databases without revealing them.
How k-anonymity works
- Hash locallyThe phone computes the SHA-1 hash of the email address or password.
- Send five charactersOnly the first five hexadecimal characters of that hash leave the device. Hundreds of unrelated credentials share any given prefix.
- Match locallyThe server returns every breached hash that starts with that prefix. The phone compares the full hash itself.
What the server learns
A five-character prefix, and nothing else. Neither ThetaSecurity nor the lookup server learns the credential, whether it matched, or who asked. The request leaves through the tunnel, so it is not tied to your network address either.
A match means the credential appeared in a breach. Change it from a device you trust, and do not reuse it anywhere.