Why a leaked password is an identity problem, not a password problem

The check hashes the password locally with SHA-1 and sends only the first five characters of that hash to Have I Been Pwned. The service returns every hash with that prefix, hundreds of unrelated ones, and the browser looks for a match. The password itself never leaves the page.

A count above zero means the exact password appears in at least one public breach corpus. Attackers feed those corpora into credential-stuffing tools around the clock. If the password is still valid anywhere, that account is one script away from being taken over, MFA or not.

The fix is never one password. It is a manager that generates unique ones, MFA that cannot be replayed, and a directory policy that blocks breached passwords at the moment they are set. The last item is what an identity review verifies.