Check keepass passwords against https://haveibeenpwned.com/Passwords
Even if Troy Hunt's API does provide some sense of privacy (as we don't share the password nor even the full SHA1), always review the tools you use with your KeePass files (such as this script which is small and you can easily see the password is not sent anywhere except HIBP API). I have reviewed libkeepass code (0.3.0, pinned in requirements) which is also small, and, as PyPI does not allow replacing existing versions, it is safe.
Also be sure to install tools you trust from places you trust or you might end up installing some shady version such as this fork which sends the full password (not the hash) to a different endpoint.
$ pip install kdbxpasswordpwned Collecting kdbxpasswordpwned Successfully installed kdbxpasswordpwned-0.3
And use the CLI
$ kdbxpasswordpwned -h usage: kdbxpasswordpwned [-h] [-k KEYFILE] [-u] [-p] kdbx positional arguments: kdbx keepass file optional arguments: -h, --help show this help message and exit -k KEYFILE, --keyfile KEYFILE Keyfile if needed -u, --show-user show username for found entries -p, --show-password show password for found entries (high shoulders?)
$ kdbxpasswordpwned /path/to/test_assets/sample.kdbx Password: Password for title1 seen 1151 times before Password for title2 seen 61164 times before
Or simply use the docker image
$ docker run --rm -ti \ -v /path/to/test_assets/sample_with_key.kdbx:/tmp.kdbx:ro \ -v /path/to/test_assets/sample.key:/tmp.key:ro \ fopina/kdbxpasswordpwned -upk /tmp.key /tmp.kdbx Password for title1 seen 1151 times before - testuser - testit Password for title2 seen 61164 times before - None - blabla