Is Google Password Checkup Legit? What It Actually Sends to Google

"Is Google Password Checkup legit?" is a reasonable thing to type before handing a security tool anything at all. The short answer is yes, it is a genuine Google feature. But the question people are really asking sits one layer down: if it checks my passwords against breach databases, does Google see my passwords?

That one has a precise, documented answer.

What it is

Password Checkup compares credentials you have saved against a set of credentials known to have appeared in third-party data breaches, and tells you when one of yours turns up. Google introduced it on its own Online Security Blog in February 2019.

The premise is simple. Billions of username and password pairs have leaked over the years. If one of yours is among them, and you are still using it, anyone working through those lists can walk into that account. Checking is worth doing.

The privacy problem it had to solve

Here is the difficulty, in Google's own framing. The feature needs to query the breach status of a username and password without revealing the information queried. At the same time it must ensure that no information about other unsafe credentials leaks in the process, and that brute force guessing is not an option.

Those requirements pull against each other. A naive implementation would send your password, or a simple hash of it, to a server and ask "is this in the list?". That hands the server exactly what it should never receive.

How it avoids sending your password

Google describes the approach as using multiple rounds of hashing, k-anonymity, and private set intersection with blinding, chosen to balance privacy, computation overhead and network latency.

Each piece does a specific job:

Multiple rounds of hashing mean the raw value never leaves your device, and the derived value is expensive to attack by brute force.

k-anonymity groups your query with enough others that it cannot be tied to you specifically. It also prevents the check from leaking information about the other compromised credentials sitting in the database.

Private set intersection with blinding is the core of it. It allows two parties to work out whether an item is in a shared set without either side revealing what it holds. The blinding is what keeps the value you are checking unreadable to Google while the comparison still produces a correct answer.

The upshot: the answer comes back, and your password is not what travelled.

What it does not cover

This is where being honest matters more than being reassuring.

Password Checkup examines the credentials it can see, which means the ones saved in your Google account or browser password manager. That scope has real edges:

• passwords you have never saved to Google are invisible to it
• passwords kept only in a different manager are outside its reach
• old accounts you have forgotten cannot be checked, because nothing knows they exist
• it reports on breaches already in the dataset, so a leak that has not surfaced yet will not appear

None of that makes the tool bad. It makes it partial, and knowing where a tool stops is the difference between using it well and trusting it blindly.

What a warning actually means

A hit tells you that a credential matching yours has appeared in a breach somewhere. It is not a statement that this particular account has been broken into.

The correct response does not depend on that distinction:

1. Change the password on that account, to something unique that you have never used elsewhere.
2. Find where else you reused it. This is the step people skip, and it is the one that matters most: reuse is the mechanism that converts one company's breach into five of your accounts.
3. Turn on two-factor authentication on anything that offers it, so a stolen password alone stops being sufficient.

If step two feels impossible because you genuinely cannot remember where a password went, that is the actual finding. It is also the argument for a dedicated password manager: not because Google's checking is untrustworthy, but because a manager knows every credential you have, can generate unique ones, and can tell you about reuse before a breach does.

The short version

Password Checkup is legitimate, and the privacy concern that sends people searching for reassurance is one Google engineered around rather than ignored: hashing, k-anonymity and private set intersection with blinding mean the check happens without your password being read.

Its limit is scope, not honesty. It sees what you have saved to Google, and nothing else. Use it, act on what it finds, and remember that the reuse it cannot see is the part most likely to hurt you.

The description of Password Checkup, including the stated design requirement to query breach status without revealing the queried information, and the use of multiple rounds of hashing, k-anonymity and private set intersection with blinding, comes from Google's Online Security Blog post introducing the feature in February 2019. Implementations evolve; verify current behaviour against Google's own documentation before relying on a specific detail. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.