sqlite> select substr(hash,1, 5) as hashbeg, count(*) as count from pwned group by hashbeg; # put result into hashcount table sqlite> select avg(count)

sqlite> select substr(hash,1, 5) as hashbeg, count(*) as count from pwned group by hashbeg; # put result into hashcount table sqlite> select avg(count) from hashcount; 478.397716142925 sqlite> select min(count) from hashcount; 381 So, I'm not sure I agree with you, if on avg almost 500 records are returned given the first 5 chars of the SHA1 hash across the 1/2 billion records. But I do agree it helps with cracking the passwords, but seeing as how all of these passwords are BAD and are known to have leaked... cracking them again isn't the use-case, the bad people likely already have all these passwords in plain text.