locked · awaiting passphrase
Your browser hashes the password and sends only the first five hex characters of the SHA-1. The password never leaves this device, and neither does the full hash. This is the same k-anonymity design Have I Been Pwned uses.
Most phone photos carry GPS coordinates, camera serial number and timestamps in EXIF. Re-encoding through a canvas destroys all of it while keeping the pixels identical to the eye. Nothing is uploaded.
Tick what is already public about you. Each attribute shrinks the crowd you can hide in. Re-identification needs roughly 25 bits.
Deletion tells you nothing about who leaked you. Give each broker a slightly different version of you, a distinct middle initial, alias email and flat number, and any future listing carrying a canary identifies the source. Use these only on broker forms, never on anything official.
Drop the original and a suspected copy. The 64-bit dHash ignores resizing, recompression and light cropping, so a reposted face still matches.
Chains an attacker could build from what is already public, ranked by impact per unit of effort. Each one names its cut point.
Paste passwords you use, one per line. They are SHA-1 hashed in this tab and only the first five characters of each hash are sent, so the server cannot reconstruct them. You get breach counts, reuse clusters and an order to rotate in.
Every request is timestamped and hashed against the one before it. Edit any row and the chain breaks, which is the point: it is evidence, not a to-do list. UK GDPR gives them one calendar month, so each receipt carries its own expiry.
Drop a photo you are about to post. It scores what the file actually carries: GPS, device strings, resolution and filename chatter. Nothing is uploaded.
Which upstream register feeds which broker. Suppressing one upstream covers every listing under it, which beats a form per site.
Matches listing fields against breach data classes, and isolates the one combination that passes identity checks.
Paste raw headers from any junk or suspicious email. It unwraps the sending chain, extracts the originating IP, checks authentication, and fingerprints the bulk sender from its tracking parameters. Parsed locally, nothing sent.
Give every service its own address. When one starts receiving spam, you know exactly which signup sold it, and burning it costs nothing.
Records each sweep so the interval between a removal and a reappearance becomes a measurement. Check timing then follows evidence rather than a habit.
Take a snapshot, do the work, come back. The diff shows what actually moved, including nothing.
Generates a versioned threat model from the register: surface, ranked paths, controls in place, one next action, and the gaps that are genuinely unknown.
Plans a consistent alternative version of you so a listing carrying it is provably from the form you used. The downside is real and stated inside.