Depends on what you mean by safe to use. The service when I tested does not record your plaintext password, but likely is recording your unsalted hash. Note this could easily be changed going forward and could later start recording plaintext passwords, unless you only input a hash on the site. EDIT: Rather than using this site, I recommend https://lastpass.com/linkedin/ (based on this answer ) as it uses https from a known entity and is likely more trustworthy.
If you type your plaintext password into the source field, client-side javascript in your browser converts that password into a unsalted SHA-1 hash, and then that SHA-1 hash gets sent over the network to leakedin.org to see if your hash is in the 6.5 million list. The actual http GET request sent from your browser to their server looks like (after typing 'password' into the field):
GET /?check=5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 HTTP/1.1
Host: leakedin.org
Connection: keep-alive
User-Agent: [scrubbed]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://leakedin.org/?check=7ecfd8f97b4729c6ff0799b0b4d40f870083b461
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: first_pv_66595923=1; _jsuid=1189493102
Query String Parametersview URL encoded
The info from plaintext password can't be recorded as the cookie doesn't change significantly with different plaintext passwords, and no AJAX requests/XHR were noted. (There is also a request sent to in.getclicky.com
but it seems to be benign web analytics -- like google analytics and does not seem to record your password in plaintext or be encoding it somehow).
However, you should note that once you try this service, even if linkedin didn't leak your unsalted hash, you just leaked your unsalted hash to an unknown entity (and that entity now has tied your password to a specific IP address) -- the very thing you were initially worried about. If you think a dedicated hacker could brute-force your hash in trillions of attempts you have now lost and need to stop using the password you just tested. However, if you already changed your password and are now just curious, you could use this service to check. If you are weary of them recording your plaintext password and not just the hash, you should recommend compute the hash on your own computer (e.g., echo -n "password" | shasum
or echo -n "password" | openssl sha1
work in linux/unix or if you have python installed you should be able to do something like python -c "import hashlib;print hashlib.sha1('your_password').hexdigest()
).