Please find my code for securely checking Haveibeenpwned for breached passwords

This code will only send a partial HASH over the internet (using HTTPS) and the second part of the HASH will be checked on the users side. Therefore, the full password will never be seen by anyone including haveibeenpwned

import hashlib
import urllib.request

def check_password(firstHash, lateHash):
    link = f"https://api.pwnedpasswords.com/range/{firstHash}"
    f = urllib.request.urlopen(link)
    for line in f.readlines():
        searchedHash, hashCount = str(line, "utf-8").strip().split(":")
        if searchedHash.lower() == lateHash.lower():
            return (f"This password has been breached {hashCount} time(s)")
    return ("This password has not been breached")

def hash_password(password):
    encoded_password = password.encode("UTF-8")
    SHA1Hash = hashlib.sha1()
    return SHA1Hash.hexdigest()

def main():
    password = input("Please enter your password: ")
    fullHash = hash_password(password)
    firstHash, lateHash = fullHash[0:5], fullHash[5:]
    print(check_password(firstHash, lateHash))

if __name__ == "__main__":


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.