sha1_prefix_suffix (breach_checker.py)

claude-bug-bounty · auth

Extracts SHA1 prefix and suffix for HIBP k-anonymity API queries.

#!/usr/bin/env python3
"""
HIBP k-anonymity password breach checker.

Reads a password wordlist, queries the HaveIBeenPwned /range/ API using
k-anonymity (only first 5 chars of SHA-1 are sent), enriches each password
with its breach count, then writes the ranked output.

Why rank by breach count:
  - HIGH count (>1M):  "Password123" — already in every generic spray list
  - SWEET SPOT (1-1k): proven-real passwords not yet over-used
  - ZERO count:        never seen — could be truly company-specific (or random)

Usage:
  tools/breach_checker.py <wordlist.txt>
  tools/breach_checker.py <wordlist.txt> -o ranked.txt --with-counts
  tools/breach_checker.py <wordlist.txt> --min-count 1 --max-count 1000000
  tools/breach_checker.py <wordlist.txt> --limit 5000   # test/preview
"""
from __future__ 

... (truncated -- full source via MCP)

See the full source, get the GitHub permalink, and search 40K more like it.

Get a free API key