Skip to content

Instantly share code, notes, and snippets.

View dontmitch's full-sized avatar

Mitchell Lee dontmitch

View GitHub Profile
@dontmitch
dontmitch / README.md
Last active January 17, 2019 15:00
Pwned Passwords Checker for LastPass

Pwned Passwords Checker for LastPass

This Ruby script allows you to easily check if any of your LastPass passwords appear in the Pwned Passwords database, indicating they've been compromised in one or more data breaches.

You can read more about the Pwned Passwords database and version two of the API in Troy Hunt's blog post.

Importantly, this script uses the Range API. That means that your actual passwords do not leave your computer. Instead, a short prefix of the SHA1 hash of your password is used to query for potentially matching SHA1 hashes of passwords that have been compromised. The full SHA1 hash of your password is then compared to those results locally to see if there is a match. You can read more about this system, known as k-anonymity, in the blog post.

To use this checker: