This tools searches your password in the leak-database from [haveibeenpwned.com](https://pwnedpasswords.com). However, your password is not beeing exposed. Instead the 5 first characters from the sha1-hash of your password are send to the [api](https://api.haveibeenpwned.com/range/):
2. Compute the sha1: 68f2b2d8713ff1c25a437db21dbbd395bfb9881e
3. Take first 5 chars: 68f2b
4. Make a request: https://api.haveibeenpwned.com/range/68f2b
5. Get a list with similar hashes that start with the same 5 chars.
6. Search for the sha1 hash (from step 2) within the list.
# Examples
## Pass passwords as arguments
Note: This approach will put all entered password in your shell command history (such as the bash history). Therefore this method is only recommended if you trust anybody else who has acces to the history or if you clean all passwords from the history.
The following shows that passwords like `password`, `p@ssw0rd` and even `p@$$wOrd` have been leaked already and should obviously never be used as passwords again. Note the use of single ticks `'` for the third and fourth password as the `$`-sign confuses the shell otherwise.
P@$sW0rD& not yet 1B34EF732FC1EB5925EEAF3155BECBB44275194A
```
## Enter password secretly into a prompt
When you invoke the script without any arguments you will be prompted for a password which you can enter without somebody else seeing the characters on the screen:
