Have I Been Pwned

How to Use This API

1. Check a Password Hash Prefix

Send first 5 chars of SHA-1 hash, get back matching full hashes:

https://api.pwnedpasswords.com/range/21BD1

2. JavaScript — Safe Password Check

Full client-side implementation using k-anonymity — your password never leaves the browser:

async function checkPassword(password) {
  const hash = await crypto.subtle.digest('SHA-1',
    new TextEncoder().encode(password));
  const hex = Array.from(new Uint8Array(hash))
    .map(b => b.toString(16).padStart(2, '0')).join('').toUpperCase();
  const prefix = hex.slice(0, 5);
  const suffix = hex.slice(5);

  const resp = await fetch(
    `https://api.pwnedpasswords.com/range/${prefix}`
  );
  const text = await resp.text();
  const matches = text.split('\n').map(l => l.split(':')[0]);
  return matches.includes(suffix);
}

checkPassword('password123').then(pwned => {
  console.log(pwned ? 'Password has been pwned!' : 'Password is safe');
});

3. Python — Password Validation

import hashlib, requests

def check_password(password):
    hash_hex = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix, suffix = hash_hex[:5], hash_hex[5:]
    resp = requests.get(
        f'https://api.pwnedpasswords.com/range/{prefix}'
    )
    return suffix in [line.split(':')[0]
                      for line in resp.text.splitlines()]

passwords = ['correcthorsebatterystaple', 'password123', 'qwerty']
for pw in passwords:
    pwned = check_password(pw)
    print(f"'{pw}': {'BREACHED' if pwned else 'Safe'}")

4. Adding padding for privacy

Add ?AddPadding=true to get responses with padding (responses are uniform in size):

https://api.pwnedpasswords.com/range/21BD1?AddPadding=true