PwnedPasswords

PwnedPasswords as a Service

Security & Privacy

Explore on GitHub Read Hacker News discussions

2Distinct people

4Mentions

0Explicit recommenders

25GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

PwnedPasswords as a Service

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month4 dated mentions

Observed mentions: 2019-04-24 23:53:04 UTC to 2020-03-02 00:27:17 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Apr 2019	2019-04-01 00:00:00 UTC	2019-05-01 00:00:00 UTC	2	1	1
May 2019	2019-05-01 00:00:00 UTC	2019-06-01 00:00:00 UTC	0	0	0
Jun 2019	2019-06-01 00:00:00 UTC	2019-07-01 00:00:00 UTC	1	0	1
Jul 2019	2019-07-01 00:00:00 UTC	2019-08-01 00:00:00 UTC	0	0	0
Aug 2019	2019-08-01 00:00:00 UTC	2019-09-01 00:00:00 UTC	0	0	0
Sep 2019	2019-09-01 00:00:00 UTC	2019-10-01 00:00:00 UTC	0	0	0
Oct 2019	2019-10-01 00:00:00 UTC	2019-11-01 00:00:00 UTC	0	0	0
Nov 2019	2019-11-01 00:00:00 UTC	2019-12-01 00:00:00 UTC	0	0	0
Dec 2019	2019-12-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	0	0	0
Jan 2020	2020-01-01 00:00:00 UTC	2020-02-01 00:00:00 UTC	0	0	0
Feb 2020	2020-02-01 00:00:00 UTC	2020-03-01 00:00:00 UTC	0	0	0
Mar 2020	2020-03-01 00:00:00 UTC	2020-04-01 00:00:00 UTC	1	0	1

What Hacker News says

4 sources

ttt111222333·Mar 2, 2020

I did something similar when I wanted to search the HIBP database and if you are okay with some false positives you can do better than your results, both in terms of speed and size. If you are okay with false positives, you can use a bloom filter and tune the number of false positives you want. I chose a false positive rate of 1 in a million so my data structure was still very accurate in determining whether a password was already hacked. It only took 30 microseconds to determine if a password was in the list and for size, was at the theoretical limit of 22 bits per element or ~1.5gb. I originally used a bloom filter which made it 2gb but given a bloom filter was just a sequence of 0s and 1s, I was able to use a golomb coding to shrink it down to 1.5gb. The time to process the original 24gb however, is something that I could have improved

Read the rest

, but I kinda lost interest once I already had something that was at the theoretical minimum size, as well as able to determine a password exists within 30 microseconds. Anyways take a look if you're interested in trying a different approach: https://github.com/terencechow/PwnedPasswords

In A journey to searching Have I Been Pwned database in 49μs

ttt111222333·Jun 11, 2019

Cool! I did something similar. First I used a bloom filter then a golomb set. https://github.com/terencechow/pwnedpasswords

In Project Svalbard: The Future of Have I Been Pwned

verdverm·Apr 24, 2019

Thanks! https://github.com/terencechow/PwnedPasswords

In Show HN: PwnedPasswords as a (Micro)Service

ttt111222333·Apr 24, 2019Submission

Show HN: PwnedPasswords as a (Micro)Service

Recently I became interested in knowing whether the passwords I used were in the list of breached passwords. One way to find out is to send your password to the link here https://haveibeenpwned.com/Passwords. However, while the owner of that website is a well respected security researcher, I still don't think it's wise to send my password to another website. So I downloaded the 24gb file, hashed my password and grepped the file for it. That unfortunately took a long time and I realized this was the perfect opportunity to use a BloomFilter and test the inclusion of a password in a set. With a bloomfilter, the 24gb file can be compressed down to ~2gb assuming a false positive rate of 1 in a million. You can achieve even better rates with lower false positives. Despite it dropping to 2gb, I wasn't satisfied and decided to compress the bloomf

Read the rest

ilter using golomb codes. This type of data structure is known as a golomb set and I was able to get the database down to ~1.475gb. That makes it small enough to exist in a microservice that any company can use to test whether users are using hacked passwords. With a golomb set the time to test a password was microseconds. I made some node js bindings and put the file in a simple express app. Now anyone can create a pwned password as a micro-service! It's open source because you can audit the code and confirm no one is logging your passwords. Anyway thought I'd share it since I'm more or less done with this. Future work could split the 2gb file into on disk files and therefore require significantly less ram to work. This would be a great use case of storing the entire list in a laptop or phone for example, where it would take 1.5gb of disk, but be able to quickly tell you if a password you are typing is in a breached list. Anyways here's the link: https://github.com/terencechow/PwnedPasswords Cheers!

5 points · Open discussion