How it works
What happens when you check something.
Four steps, from paste to verdict, and exactly what we keep at the end.
-
Step 1
You paste it
A link, a text message or an email body. No account needed for your 3 free checks a day.
-
Step 2
It's turned into a one-way code
Our edge server makes a one-way code (SHA-256) of what you pasted. That code, not your text, is what we keep.
-
Step 3
The AI reads it
The AI judges the text in memory. We don't save it. Our AI provider, Anthropic, may keep it for up to 30 days for safety review and doesn't train on it.
-
Step 4
You get a verdict
Safe, suspicious or scam, how sure the AI is, and the reasons in plain language. AI can be wrong, so treat it as a second opinion.
Follow one check, and see what we keep.
Switch between a scam link and a safe one.
- You paste A link or message
- Hashed at our edge Turned into a one-way code
- AI reads it in memory Nothing written down
- Verdict comes back Verdict, confidence, reason
- What we keep Site name only if a scam 80%+
Step 1 of 5 · You paste
https://secure.paypa1-login.com/verify?id=48213&email=you@example.com
You paste a link, text message or email you are unsure about.
- 1. You paste: You paste a link, text message or email you are unsure about.
- 2. Hashed at our edge: Our edge server turns it into a one-way code (SHA-256). That code, not your text, is what we keep. The code doesn't contain your text.
- 3. AI reads it in memory: The AI reads the text in memory to judge it. We don't save it. Our AI provider, Anthropic, may keep it for up to 30 days for safety review and doesn't train on it.
- 4. Verdict comes back: You get a verdict, how sure the AI is (0–100%), and the reasons in plain language.
- 5. What we keep: Always: the one-way code, the verdict and the AI's reason. Only if the AI rates it a scam with 80%+ confidence: the website's name, never the full link and never your name or account. To stop abuse, each check also logs a scrambled (salted) form of your network address for up to 2 years.
Password checks work differently
Your browser turns the password into a one-way code before anything is sent, so the password itself never leaves your device. Have I Been Pwned only ever sees the first 5 characters of that code, and that short prefix is all we keep.
Want the details? Read the privacy summary or see what's coming next.