5 ms·

You can check against the API with just the first characters of your hashed password (SHA-1 or NTLM), for example: https://api.pwnedpasswords.com/range/21BD1 ht

You can check against the API with just the first characters of your hashed password (SHA-1 or NTLM), for example: https://api.pwnedpasswords.com/range/21BD1 https://api.pwnedpasswords.com/range/21BD1 or you can download the entire dataset.

zahlman 10mo ago
Second line I already notice: > 000F6468C6E4D09C0C239A4C2769501B3DD:5894 ... Does the 5894 mean what I think it does?
- esnard 10mo ago
  5894 means that the password appeared 5894 times in the dataset. 5894 is not the password associated with the hash.
  - zahlman 10mo ago
    Yes, it did mean what I thought, then. But I guess some passwords appear far more often than that in the dataset.
    - lmm 10mo ago
      Some passwords are far more commonly used than others; that isn't surprising.
- red369 10mo ago
  I remember when I was searching the file for some passwords my friends and family use, it took me a while to work out that number too. There are some passwords that many people seem to independently come up with and think must be reasonably secure. I suppose they are to the most basic of attacks.
ekjhgkejhgk 10mo ago
How can you download the entire dataset?
- MattSteelblade 10mo ago
  Several open source tools can be found on GitHub, but here’s the “official” one https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- windsurfer 10mo ago
  You can download the entire dataset using curl (will be 40+ GB) curl -s --retry 10 --retry-all-errors --remote-name-all --parallel --parallel-max 150 "https://api.pwnedpasswords.com/range/{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}"
  - ekjhgkejhgk 10mo ago
    It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.
    - windsurfer 10mo ago
      It is officially recommended by the Troy Hunt: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/issues/79#issuecomment-2407963141 https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/i...
      - ekjhgkejhgk 10mo ago
        That's crazy, thank you.
      - ErroneousBosh 10mo ago
        That speaks to a certain confidence in one's servers ability to hold up under load, doesn't it? "Oh you want your own copy? Sure, just thrash seven shades of shit out of the database. Here's how."

zahlman 10mo ago

Second line I already notice: > 000F6468C6E4D09C0C239A4C2769501B3DD:5894 ... Does the 5894 mean what I think it does?

esnard 10mo ago
5894 means that the password appeared 5894 times in the dataset. 5894 is not the password associated with the hash.
- zahlman 10mo ago
  Yes, it did mean what I thought, then. But I guess some passwords appear far more often than that in the dataset.
  - lmm 10mo ago
    Some passwords are far more commonly used than others; that isn't surprising.
red369 10mo ago
I remember when I was searching the file for some passwords my friends and family use, it took me a while to work out that number too. There are some passwords that many people seem to independently come up with and think must be reasonably secure. I suppose they are to the most basic of attacks.

ekjhgkejhgk 10mo ago

How can you download the entire dataset?

MattSteelblade 10mo ago
Several open source tools can be found on GitHub, but here’s the “official” one https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
windsurfer 10mo ago
You can download the entire dataset using curl (will be 40+ GB) curl -s --retry 10 --retry-all-errors --remote-name-all --parallel --parallel-max 150 "https://api.pwnedpasswords.com/range/{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}"
- ekjhgkejhgk 10mo ago
  It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.
  - windsurfer 10mo ago
    It is officially recommended by the Troy Hunt: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/issues/79#issuecomment-2407963141 https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/i...
    - ekjhgkejhgk 10mo ago
      That's crazy, thank you.
    - ErroneousBosh 10mo ago
      That speaks to a certain confidence in one's servers ability to hold up under load, doesn't it? "Oh you want your own copy? Sure, just thrash seven shades of shit out of the database. Here's how."