Please find my code for securely checking Haveibeenpwned for breached passwords
This code will only send a partial HASH over the internet (using HTTPS) and the second part of the HASH will be checked on the users side. Therefore, the full password will never be seen by anyone including haveibeenpwned
import hashlib
import urllib.request
def check_password(firstHash, lateHash):
link = f"https://api.pwnedpasswords.com/range/{firstHash}"
f = urllib.request.urlopen(link)
for line in f.readlines():
searchedHash, hashCount = str(line, "utf-8").strip().split(":")
if searchedHash.lower() == lateHash.lower():
return (f"This password has been breached {hashCount} time(s)")
return ("This password has not been breached")
def hash_password(password):
encoded_password = password.encode("UTF-8")
SHA1Hash = hashlib.sha1()
SHA1Hash.update(encoded_password)
return SHA1Hash.hexdigest()
def main():
password = input("Please enter your password: ")
fullHash = hash_password(password)
firstHash, lateHash = fullHash[0:5], fullHash[5:]
print(check_password(firstHash, lateHash))
if __name__ == "__main__":
main()