Depends on what you mean by safe to use. The service when I tested does not record your plaintext password, but likely is recording your unsalted hash. Note this could easily be changed going forward and could later start recording plaintext passwords, unless you only input a hash on the site. EDIT: Rather than using this site, I recommend https://lastpass.com/linkedin/ (based on this answer ) as it uses https from a known entity and is likely more trustworthy.
GET /?check=5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 HTTP/1.1
Cookie: first_pv_66595923=1; _jsuid=1189493102
Query String Parametersview URL encoded
The info from plaintext password can't be recorded as the cookie doesn't change significantly with different plaintext passwords, and no AJAX requests/XHR were noted. (There is also a request sent to
in.getclicky.com but it seems to be benign web analytics -- like google analytics and does not seem to record your password in plaintext or be encoding it somehow).
However, you should note that once you try this service, even if linkedin didn't leak your unsalted hash, you just leaked your unsalted hash to an unknown entity (and that entity now has tied your password to a specific IP address) -- the very thing you were initially worried about. If you think a dedicated hacker could brute-force your hash in trillions of attempts you have now lost and need to stop using the password you just tested. However, if you already changed your password and are now just curious, you could use this service to check. If you are weary of them recording your plaintext password and not just the hash, you should recommend compute the hash on your own computer (e.g.,
echo -n "password" | shasum or
echo -n "password" | openssl sha1 work in linux/unix or if you have python installed you should be able to do something like
python -c "import hashlib;print hashlib.sha1('your_password').hexdigest()).