5 ms·
Is there a way I can hash my password myself then check if the hash is in the database via the web?
by sleavey 6y ago
Is there a way I can hash my password myself then check if the hash is in the database via the web?
- supakeen 6y agoSure, see: https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByR...
- advisedwang 6y agoYes: do a SHA1 of your password (no trailing newline), then fetch https://api.pwnedpasswords.com/range/{first https://api.pwnedpasswords.com/range/{first 5 hash chars}. If the full hash appears in the results, the password has been seen in a breach.
- tsbinz 6y agoSmall correction: It's not the full hash that appears in the results, it's the suffix (so the part after the 5 chars you put into the URL). If you don't want the password to end up in your shell history, this works on in the shell with common tools: tr -d '\n' | sha1sum Then type the password you want to look for, hit enter and control-d. You can test with "common" passwords like https://www.reddit.com/r/XFiles/comments/6ge7h4/mulders_home_computer_password_is_8_characters/ https://www.reddit.com/r/XFiles/comments/6ge7h4/mulders_home... if you're doing it right.
- notdang 6y agoif you have bash, awk and sha1sum then you can try this: export PASS=mypassword then PT=$(echo -n $PASS | gsha1sum | awk '{print toupper($1)}'); curl -s https://api.pwnedpasswords.com/range/$(awk https://api.pwnedpasswords.com/range/$(awk '{print substr($0,1,5)}' <<< $PT) | grep $(awk '{print substr($0,6)}' <<< $PT)
- moltar 6y agoI wrote an extremely light, dependency free NPM package that also has a CLI version. https://github.com/moltar/pwnedpasswords https://github.com/moltar/pwnedpasswords