3 ms·
Yea it would seem like it, and worse you may drive users to adopt a 'less secure' passphrase because the first 5 characters of the hash of their super complex/l
by craftyguy 8y ago
Yea it would seem like it, and worse you may drive users to adopt a 'less secure' passphrase because the first 5 characters of the hash of their super complex/long passphrase might collide with the first 5 characters of the hash of 'password1', so they may pick a weaker passphrase just to get the system to accept it?
- jazoom 8y agoIt's intended that you compare the returned full hashes. Otherwise why would the API even return them? This URL is the entire API. Just change the last parameter to whatever 5 characters you want: https://api.pwnedpasswords.com/range/aaaaa https://api.pwnedpasswords.com/range/aaaaa Note that the returned hashes omit the first 5 characters, since that would be a waste of resources. You should also note that ALL possible combinations of 5 characters return at least 300 results. So it doesn't make sense to use this API any other way.