4 ms·
But Troy could still very easily guess the complete hash. It's the one with the 47,205 hits.
by febed 9y ago
But Troy could still very easily guess the complete hash. It's the one with the 47,205 hits.
- kingvash 9y agoYes but Troy doesn't learn the hashes of uncompromised passwords
- kbenson 9y agoBut's it's not always that hash. The password you're checking may not be on the list. This is just a quick check to see if the password in question is on the list, in which case it may be a poor choice depending on how often it's seen. For example, say I want to check "gSAey27tgGsaEG". That hashes to c2e5dfb023cd42df94751581cba33b24bc011027. https://api.pwnedpasswords.com/range/c2e5d https://api.pwnedpasswords.com/range/c2e5d has no entry for fb023cd42df94751581cba33b24bc011027, so it's not even in the list of passwords. Put another way, it averages a few hundred hashes per prefix based on the total password list size (~500M), but there's 2^136 possible has suffixes per prefix. There's no point in guessing that.