YOUR PASSWORD is probably already leaked.

your password is probably already out there

here's an uncomfortable fact. if you've been using the internet for more than a few years, at least one password you've used is sitting in a breach dump somewhere, already cracked, already indexed, already for sale or just floating around for free. not maybe. probably. the good news is you can check this yourself in about ten seconds without ever typing your actual password into a website you don't control. that's what we're doing today.

the tool: have i been pwned passwords api

troy hunt runs a service called have i been pwned, and one part of it is a massive database of passwords pulled from real world breaches. it's not usernames or emails paired with passwords, it's just the passwords themselves, hashed with sha1, sitting in a giant list of "these have been seen in breaches before." you can query that list to see if your password is in it.

the clever part is how you query it. you never send your actual password or even your full password hash to their server. you use something called k-anonymity, which sounds fancy but is a pretty simple idea once you see it in action.

breaking down the command

curl https://api.pwnedpasswords.com/range/21BD1

here's what's happening step by step:

1. hash your password. before you ever touch the api, you take your password and run it through sha1, a hashing algorithm that turns any input into a fixed length string of characters. so "password123" becomes something like 21BD1C4A1F... a long hex string.

2. chop off the first 5 characters. that's the "21BD1" in the url. that's called the hash prefix.

3. send only the prefix. the curl command sends just those first 5 characters to the api, not your full hash and definitely not your plaintext password.

4. the api sends back a bucket. the server responds with every hash in its database that starts with those same 5 characters, along with how many times each one has shown up in breaches. this could be hundreds of hashes.

5. you compare locally. you take your full hash and check if it appears anywhere in that returned list, on your own machine. if it matches, your password is compromised. if it doesn't, you're clear, at least for this specific check.

the whole point of this design is that troy hunt's server never actually learns your password or even your full hash. it just tells you "here's everyone who shares your first 5 characters, go check yourself." that's k-anonymity in practice, and it's a genuinely good piece of privacy engineering.

why this matters for defenders

attackers don't need to break into your account if they can just guess your password because it's already sitting in a public breach list. credential stuffing attacks work by taking known breached passwords and username combos and throwing them at every login page they can find. if your password shows up in this database, it's not a hypothetical risk, it's already in the toolkit some bot is using right now.

doing this the easy way

you don't have to hash things by hand with openssl every time. most password managers, including bitwarden, 1password, and even chrome and firefox's built in checkers, already run this exact check for you automatically and flag any saved password that's been seen in a breach. that's the same api under the hood, just wrapped in a nicer interface.

if you want to do it manually for learning purposes, you can generate the sha1 hash locally like this:

echo -n "yourpassword" | sha1sum

then take the first 5 characters and query the api the same way. never paste your real password into a random website's search box, even if it claims to check breaches. this api approach is safe specifically because you're not sending your password anywhere.

the takeaway

finding out your password is breached isn't the scary part, it's expected. the scary part is doing nothing about it. if a check comes back positive, change that password everywhere you've reused it, turn on a password manager so you stop reusing passwords in the first place, and enable two factor authentication wherever you can so a leaked password alone isn't enough to get someone in. the tools to defend yourself here are free and take less time than scrolling this reel twice.