3 ms·
You can download a database from haveibeenpwned of SHA-1s of all the passwords, which is the only way you should be checking user passwords against an external
by bscphil 7y ago
You can download a database from haveibeenpwned of SHA-1s of all the passwords, which is the only way you should be checking user passwords against an external database. It's also a good way!
- fwip 7y agoDownloading the database is best, but you can also safely use their range API [1]. This can be run either client-side or server-side. I built a toy webpage using the API [2], and you can see how straightforward the API is to use by checking the script [3]. [1] https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR... [2] https://safepasswordchecker.hashbase.io/ https://safepasswordchecker.hashbase.io/ [3] https://safepasswordchecker.hashbase.io/script.js https://safepasswordchecker.hashbase.io/script.js