Meer-Web/Breached-password-check
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Initial release

Browse Source
This commit is contained in:
Frank Bischof
2023-01-12 11:59:58 +01:00
parent dceafe326f
commit 29d2c37103
2 changed files with 79 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -2
View File
@@ -1,2 +1,16 @@
# Breached-password-check
PHP function for checking passwords against the "Have I been Pwned" database
# Password check using k-Anonymity
PHP function for checking passwords against the pwnedpasswords.com database
You can add this function inside your functions file.
k-Anonymity means that it does NOT send your password over the internet but hashes it and only sends a part of the hash to request a list of all hashed passwords which have been compromised.
You will not send your password over the internet!
For example your password is 'Welcome01'
This will be hashed to: a1a2094820f0313d61da4f44032013eaf6c2b7d3
Only 'a1a20' will be send to the pwnedpasswords.com API which will return a list of ALL passwords which have been compromised where the hash starts with 'a1a20'.
You then download that list and check if the full hashed password is found it the list.
In case it is found your password is compromised and you can build your site that this password cannot be used or just warn the user.