checkpassword

README

checkpassword

This command checks passwords against haveibeenpwned.com's alphbetized, SHA1 password list.

The latest password list as of writing is 23GB uncompressed, so a naive text search can be slow and memory-intensive. This program mmaps the file and binary searches over it. This approach is fast and has minor memory usage.

go get github.com/jbowens/checkpassword
go install github.com/jbowens/checkpassword
checkpassword -file ~/pwned-passwords-sha1-ordered-by-hash-v4.txt "password"

Documentation

Overview

Command checkpassword checks passwords against a SHA1 password list.

It was built to be used with the password list from https://haveibeenpwned.com/Passwords. As such, it expects the password list to consist of alphabetized, capitalized, hex-encoded SHA1 hashes. It expects each hash to be on its own line with a colon delineating the hash from the number of occurrences in breaches.

For example,

000000005AD76BD555C1D6D771DE417A4B87E4B4:4
00000000A8DAE4228F821FB418F59826079BF368:2
00000000DD7F2A1C68A35673713783CA390C9E93:630

The checkpassword command mmaps the password list and performs binary search over the mmaped file.