3 ms·
haveibeenpwned has an api to check your password against their known list that only requires to send the first 5 characters of the sha-1 hash: https://api.pwned
by atnurbel 8y ago
haveibeenpwned has an api to check your password against their known list that only requires to send the first 5 characters of the sha-1 hash: https://api.pwnedpasswords.com/range/5407a https://api.pwnedpasswords.com/range/5407a.
You get a list of corresponding hash suffixes and check if yours is there.
https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsBy...
- fwip 8y agoThat interactive javascript checker on their site also uses that API, so in theory HIBP doesn't get sent a copy of your password. A couple of weeks ago I spun up a little clone with slightly-simpler javascript, just in case HIBP starts serving malicious javascript: https://safepasswordchecker.hashbase.io/ https://safepasswordchecker.hashbase.io/ Feel free to download the site and javascript for a static copy. Or reuse or modify and reshare as you like, as long as you're not malicious. Edit: This site was made with Beaker Browser (https://beakerbrowser.com https://beakerbrowser.com), which is rad, and you should check it out. Feel free to download / fork this site.
- l0b0 8y agoI did the offline check yesterday and wrote up how to do it: https://stackoverflow.com/q/54249403/96588 https://stackoverflow.com/q/54249403/96588