Breached Password Check (lib/breached-password.ts)

Implements HaveIBeenPwned k-anonymity password check using SHA-1 hashing. Reuse during user registration or password updates to verify credential safety.

// Source: https://github.com/rekey-dev/rekey | License: MIT | Copyright 2026 Rekey
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * HIBP Pwned Passwords k-anonymity check.
 *
 * We never send the raw password (or even a full hash) to HIBP. The
 * protocol is:
 *
 *   1. SHA-1 the password, yes SHA-1, that's the wire format HIBP uses.
 *   2. GET https://api.pwnedpasswords.com/range/<first 5 hex chars>
 *   3. Response is a `\r\n`-delimited list of `SUFFIX:COUNT` rows.
 *   4. If the remaining 35 chars of our hash appear in the list, the
 *      password has been seen `COUNT` times across known breaches.
 *
 * We treat any non-zero match as "breached". This is conservative, HIBP
 * surfaces counts as low as 1, and the value of breach-checking is the
 * categorical si

... (truncated -- full source via MCP)