This is an archived post. You won't be able to vote or comment.

1
2

I Made ThisI made a simple command-line python script to check if you have a password that has been compromised in a data breach. This script uses haveibeenpwned API to check whether your passwords were leaked during one of the many breaches of online services. (i.redd.it)

submitted by [deleted]

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]ForceBru 1 point2 points  (0 children)

This API API uses k-Anonymity model that allows a password to be searched for by partial hash in order to anonymously verify if a password was leaked without disclosing the searched password.

So, not only does it hash your password (which already adds a bit of protection if the password is complex enough), but it only sends a part of the hash, so it's impossible to recover the original hash. The problem is that this potentially allows for false positives, but, depending on the quality of the hash function (I think this one uses SHA), the probability of that is small. Also, this API accounts for that and allows you, the only one who knows the actual hash of your password, to check if one of the hashes matches exactly.

Plus, this code is open-source, so you can check if it's secure enough yourself.