Closed leymannx closed 6 years ago
It currently takes in plain text passwords, hashes them to SHA1 and passes the first few characters of the hash to the API. Currently the haveibeenpwned passwords API only supports plain text passwords or SHA1 hashes.
More info here: https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange
Ah I see. Thanks for clarification. And even if I have a database full of sha1 passwords then I have a even bigger problem :D
My pleasure. :+1:
Maybe I didn't see it or am I right that it currently only takes blank strings as input? Useful for the exact moment when users have to choose a new password.
But it would be even nicer to also be able to use this tool for checking against already hashed passwords. Would that work with Troys API? With different hash types? Or does it anyways only work with sha1?