Have I Been Pwned API Support

[leifdreizler]

Feature Request
An optional flag for running a given password against the HIBP API. Presence of the password in the HIBP database would result in a lowered score and a custom message. To save on requests to the HIBP API it could run after the basic checks have completed—no need to run "password1!" against HIBP. Requests to the API could fail silently.

[mkopinsky]

A wrapper library which calls zxcvbn and then HIBP would make more sense than integrating the two directly (imo). I'd venture that someone out there must have built such a thing (whether as a library or just in their application code) - anyone want to open source it (and link from this issue)?

[mchubby]

Edit: oops, I thought I was in the KeepasXC repo, sorry if this comes out as off-topic

Janek Bevendorff @phoe​rious addressed this:
https://keepassxc.org/blog/2018-02-24-pwned-database/

On Keepass I use the (open-source) HIBPOfflineCheck plugin that tries to match the SHA1 against a downloaded database dump at https://haveibeenpwned.com/Passwords

It has the benefit of not supplying the hash to an external API but eats quite a lot of space (22+ GiB).

[robalb]

Janek Bevendorff @phoe​rious addressed this:
https://keepassxc.org/blog/2018-02-24-pwned-database/

Off topic disagreement: HIBP integration is useless only if you are building a password manager.
As the article points out HIBP is not very effective for measuring password strength, but combined with zxcvbn in a login form It can detect reused passwords, or common passwords that are not in the zxcvbn list. It's pretty useful

[oscrx]

If anyone is going to create a wrapper, this might be a useful reference implementation: https://github.com/jamiebuilds/havetheybeenpwned/blob/master/lib/implementation.js