haveibeenpwned.sh - Check pwnage of password.

README.md

haveibeenpwned.sh - Check pwnage of password.

This script checks a password is registered or not in Pwned Password. To keep secret on http request, the password will be encrypted with SHA1 hash.

References

• Validating Leaked Passwords with k-Anonymity

Relations

• Have I been pwned

haveibeenpwned.sh

#!/usr/bin/env bash
#
# haveibeenpwned.sh - Check pwnage of password.
# Copyright (c) 2019 Koichi OKADA. All rights reserved.
# This script is distributed under the MIT license.
#

SGR_reset="\e[0m"
SGR_fg_red_bold="\e[31;1m"
SGR_fg_green_bold="\e[32;1m"

function getpw () # [<PROMPT>]
# Get password with masked echo back.
{
  local prompt="${1:-Password: }"
  local password=""
  local ch
  while IFS="" read -p "$prompt" -rsn1 ch; do
    case "$ch" in
    "")
      break
      ;;
    $'\x15')
      prompt="${password//?/$'\b \b'}"
      password=""
      ;;
    $'\x08'|$'\x7f')
      [ -n "$password" ] && prompt=$'\b \b' || prompt=""
      password="${password%?}"
      ;;
    *)
      prompt="*"
      password+="$ch"
      ;;
    esac
  done
  [ -t 0 ] && echo >/dev/tty
  echo -n "$password"
}

function haveibeenpwned () # [<password>]
# Check pwnage of password.
{
  local SHA1="$( (( 0 < $# )) && echo -n "$1" || getpw | sha1sum | awk '$0=toupper($1)' )"
  wget -qO- https://api.pwnedpasswords.com/range/${SHA1:0:5} | grep ${SHA1:5} \
  && echo -e "${SGR_fg_red_bold}Oh no - pwned!${SGR_reset}" \
  || echo -e "${SGR_fg_green_bold}Good news - no pwnage found${SGR_reset}"
}

haveibeenpwned "$@"