4 ms·
Yes: do a SHA1 of your password (no trailing newline), then fetch https://api.pwnedpasswords.com/range/{first https://api.pwnedpasswords.com/range/{first 5 hash
by advisedwang 6y ago
Yes: do a SHA1 of your password (no trailing newline), then fetch https://api.pwnedpasswords.com/range/{first https://api.pwnedpasswords.com/range/{first 5 hash chars}. If the full hash appears in the results, the password has been seen in a breach.
- tsbinz 6y agoSmall correction: It's not the full hash that appears in the results, it's the suffix (so the part after the 5 chars you put into the URL). If you don't want the password to end up in your shell history, this works on in the shell with common tools: tr -d '\n' | sha1sum Then type the password you want to look for, hit enter and control-d. You can test with "common" passwords like https://www.reddit.com/r/XFiles/comments/6ge7h4/mulders_home_computer_password_is_8_characters/ https://www.reddit.com/r/XFiles/comments/6ge7h4/mulders_home... if you're doing it right.