Pwned Passwords

Have I Been Pwned's corpus of passwords exposed in data breaches, with a free API that tells you whether a password is in it without the password or its full hash leaving your device.

Sites use it at registration and at password change to refuse passwords criminals already hold, the defence credential stuffing calls for. The lookup is a range search: the client sends the first five characters of the password's SHA-1 hash and compares the returned suffixes itself.

Pwned Passwords launched on 3 August 2017 with 306 million passwords from breaches, released for download so that any system could check new passwords against them. Version 2, on 22 February 2018, held 501,636,842 unique passwords that had appeared 3,033,858,815 times across breaches, and added the range search designed with Junade Ali of Cloudflare.

The search applies k-anonymity. The client hashes the candidate password, sends only the first five hexadecimal characters of the hash, and receives every suffix in the corpus that shares that prefix, each with the number of times it has been seen; the match, if any, is found on the client, so the service never learns which password or hash was checked. The API accepts the prefix of a SHA-1 or an NTLM hash, needs no authorisation, and can pad each response to between 800 and 1,000 entries so that an observer of the encrypted traffic cannot infer the prefix from the response size. The whole corpus can also be downloaded with an open source tool and run offline.

On 28 May 2021 Pwned Passwords became open source under the .NET Foundation, and the FBI began feeding it compromised passwords found in its investigations. Cloudflare provides the infrastructure that serves it.

Also known as: pwnedpasswords, range api, breached password check

Sources

← All glossary entries