Password generation and strength estimation happen entirely in your browser. For breach checking, only the first 5 characters of the SHA-1 hash of the password (NOT the password itself) are sent to the Have I Been Pwned API using its k-anonymity model; the full password never leaves your device. If you prefer zero network calls you can work offline (breach status will show as unavailable). You can also save this page (Right click > Save As) and run it locally. Always be cautious of any website offering to create or check passwords—this one is designed to minimize exposure.