I want to use a client-side JS app, but I want to prevent it from leaking sensitive data.
For example, I want to check if my password is compromised using the haveibeenpwned service, which accepts SHA1 hashes. I've found a site that lets me generate SHA1 hashes that do not use a server to do so. But I need to enter my password there, and I'm worried the service will leak it to some database.
I'd like to make sure the SHA1 generator site has no way of sending my password anywhere. I don't trust that site.
The process I'm thinking of:
- Use incognito mode. This prevents the site from storing information.
- After the page is loaded, shut it off the network by using the DevTools (f12 -> network -> offline). This prevents the site from communicating to the outside.
Is this process secure? Are there any ways a site could send or store anything?
Note: I know I can generate an SHA1 from the command line, but I'm looking for a secure web-based one.