Pwned Passwords uses a model called k-anonymity to let you check whether a password has been seen before without ever sending the full password or its complete hash to the service. Instead, your password is hashed locally and only the first 5 characters of the SHA-1 hash are sent to the API. The service returns a list of matching suffixes, and the full comparison happens on your side so the password itself remains private.
and you can either download the open source client from GitHub, or spin up your own with their API (i would imagine that you can almost do this in a bash one-liner, but haven’t looked into the details yet). that sounds good enough to me
according to their website:
and you can either download the open source client from GitHub, or spin up your own with their API (i would imagine that you can almost do this in a bash one-liner, but haven’t looked into the details yet). that sounds good enough to me