A journey to searching Have I Been Pwned database in 49μs
This is a really informative write-up and an excellent learning exercise.<p>It's worth noting that haveibeenpwned's API has a really clever design for allowing people to look up their passwords without transmitting them to the site.<p>It's explained here: <a href="https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/" rel="nofollow">https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...</a><p>The short version is that you can take the first 5 characters of a SHA-1 hash and hit this endpoint:<p><a href="https://api.pwnedpasswords.com/range/21BD1" rel="nofollow">https://api.pwnedpasswords.com/range/21BD1</a><p>The endpoint returns (right now) a list of 528 full hashes along with counts. You can compare your full calculated SHA-1 hash to that list to see if the password is present in the dump.<p>The trick here is called k-Anonymity - I think it's a really elegant solution. This technique is written up in more detail here: <a href="https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/" rel="nofollow">https://blog.cloudflare.com/validating-leaked-passwords-with...</a>