haveibeenfacebooked-api

From what I can see, this site sends your whole number to the backend to search for a number in the dump[0], while haveibeenpwned.com will hash the input, send only a prefix to the server and receive a list of hashes with the same prefix. If your hash is in the list, you've been pwned, but you can check without leaking your data to HIBP. Edit: I just checked, seems like the form on the frontpage of HIBP also submits your complete email/phone number. Pretty sure I read about how you don't have to submit your personal data to validate against HIBP, not to long ago... [0]: https://github.com/Fumaz/haveibeenfacebooked-api/blob/master...

I checked someone who was part of the leak and the correct initials came up so unless that is by chance, it does seem to be querying the database. You can also read the source code [1] where it does an api call to get the data. We can be pretty sure the results are legit but yes of course it could be running malicious code and stealing phone numbers. Check the raw data if you are worried[2]. [1] https://github.com/Fumaz/haveibeenfacebooked-api [2] https://archive.is/MZqak