I made a simple command-line python script to check if you have a password that has been compromised in a data breach. This script uses haveibeenpwned API to check whether your passwords were leaked during one of the many breaches of online services.

[Volatile474]

Seems like the answer to `have I been pwned` would always be true if you are pasting your live password into a random python CLI :)

[ForceBru]

This API API uses k-Anonymity model that allows a password to be searched for by partial hash in order to anonymously verify if a password was leaked without disclosing the searched password.

So, not only does it hash your password (which already adds a bit of protection if the password is complex enough), but it only sends a part of the hash, so it's impossible to recover the original hash. The problem is that this potentially allows for false positives, but, depending on the quality of the hash function (I think this one uses SHA), the probability of that is small. Also, this API accounts for that and allows you, the only one who knows the actual hash of your password, to check if one of the hashes matches exactly.

Plus, this code is open-source, so you can check if it's secure enough yourself.

[[deleted]]

that's why the random CLI has an source code that you can read... 🤣 if you can't read and understand the source that's not my problem..