// the find
mikepound/pwned-search
Pwned Password API lookup
A command-line tool that checks passwords against the HaveIBeenPwned API using the k-anonymity model — only the first 5 characters of the SHA-1 hash are sent, so your actual password never leaves your machine. It's a weekend project that grew into a multi-language collection: Python, Go, Haskell, Java, C#, PHP, PowerShell, and more. Useful for auditing a list of passwords or wiring into a quick shell script.
The k-anonymity implementation is correct and the README is honest about the shell-history risk of passing passwords as arguments. The multi-language coverage is genuinely handy — if you need to drop this into an existing codebase, there's probably already a port in your language. Docker support means you can run it without touching your Python environment. The core Python script is small enough to read and audit in five minutes, which matters when the tool handles credential data.
Last touched July 2024 and the README still says 'pip install requests' with no mention of a virtual environment, pyproject.toml, or any packaging — it's a bare script, not a proper package. The multi-language ports are unsynchronized orphans with no shared test suite; the Go port may handle edge cases differently than the Python one and there's no way to know. No rate-limiting or retry logic, so feeding a large password list will eventually get you throttled. The GUI version (pwnedGUI.py) appears to be an afterthought with no documentation at all.