password_checker

The script is designed to check if passwords have been exposed in data breaches and whether they are part of a list of commonly used passwords. It uses the Have I Been Pwned (HIBP) API for breach data and checks local files for common passwords. This Python script evaluates the security of passwords by checking against two sources: a local list containing 1000 passwords generated by ChatGPT and an external API known as HIBP (Have I Been Pwned). The script uses k-anonymity – a model for protecting privacy, meaning that passwords are encrypted with the SHA-1 algorithm, and only the first 5 characters are used to query the HIBP API, eliminating the possibility of a man-in-the-middle attack.

This is how it works:

This is how it works:

1. Functionality:

   • The script processes each password provided as an argument.
   • It first checks if the password is in a locally stored file of common passwords.
   • If not found in the local list, it queries HIBP using the first 5 characters of the SHA-1 hash of the password.

2. API Integration:

   • The script uses the requests library to make HTTP requests to the HIBP API.
   • It constructs a URL based on the first 5 characters of the hashed password and retrieves the response.

3. Hashing:

   • Passwords are converted into SHA-1 hashes using hashlib.
   • The first 5 characters of the hash are used to query the HIBP API, while the remaining part is checked against known breach data.

4. Output:

   • For each password, the script outputs whether it's a common password or has been involved in a data breach.
   • The results are formatted in a structured manner for clarity.

5. Error Handling:

   • The script includes error handling for cases where the local file is missing or unreadable, providing informative messages to the user.

---

Sources

1. Have I Been Pwned (HIBP) API: This API provides a list of millions of breached passwords, which are hashed using SHA-1 and stored in a database.
2. A local common password list (common_passwords.txt): This file contains a list of common passwords AI-generated that should be avoided.

Here's a breakdown of the code:

Importing libraries

The script starts by importing four libraries:

• requests: for making HTTP requests to the HIBP API
• hashlib: for hashing passwords using SHA-1
• sys: for accessing command-line arguments
• import time: for delay between requests, 1.5 seconds

Functions

The script defines four functions:

1. request_api_data(query_char)

This function sends a GET request to the HIBP API with the first five characters of the password's SHA-1 hash as a query parameter (query_char). It returns the response object.

2. get_password_leaks_count(hashes, hash_to_check)

This function takes two parameters:

• hashes: the response text from the HIBP API ( split into lines)
• hash_to_check: the remaining five characters of the password's SHA-1 hash

It iterates over the lines in hashes and checks if the second part (h) matches the hash_to_check. If a match is found, it returns the corresponding count. Otherwise, it returns 0.

3. pwned_api_check(password)

This function takes a password as input and:

1. Hashes the password using SHA-1
2. Extracts the first five characters (first5_char) and the remaining five characters (tail)
3. Calls request_api_data with first5_char
4. Calls get_password_leaks_count with the response from HIBP API and tail

The function returns the count of password breaches found.

4. check_common_password(password)

This function checks if a password is in the local common password list (common-password.txt). If the file is not found or cannot be read, it skips the check and returns False.

Main function The main function takes command-line arguments as input (passwords to check). It:

1. Prints a header with column names
2. Iterates over each password:
   • Checks if the password is in the local common password list
   • If not, checks the HIBP API using pwned_api_check
3. Prints the result for each password with an extra newline at the end

Entry point

The script uses the if __name__ == '__main__': guard to ensure that the main function is only executed when the script is run directly (not imported as a module).

When run, the script expects one or more passwords as command-line arguments. Without arguments (passwords), it prints an error message and exits with a non-zero status code.

Example usage:

python pwned_passwords.py password123 commonpass

This would check if password123 and commonpass have been compromised in any data breaches or are in the local common password list. ############################################################################################################

Detailed Code Explanation

It performs two main checks:

1. Local common password check: Verifies if the password exists in a local file (common_passwords.txt) containing a list of commonly used passwords.
2. HIBP API check: Uses the "Have I Been Pwned" (HIBP) API to check if the password has been exposed in known data breaches.

Here’s a breakdown of how your code works:

1. Importing Required Modules

import requests      
import hashlib        
import sys
import time

• requests: For making HTTP requests to the HIBP API.
• hashlib: For hashing passwords using SHA-1 (required by the HIBP API).
• sys: For handling command-line arguments and exiting with appropriate status codes.
• import time: for delay between requests, 1.5 seconds

API_REQUEST_DELAY = 1.5

• Added as a constant to specify the delay duration in seconds between requests.

2. HIBP API Integration

request_api_data(query_char)

• Sends a request to the HIBP API with the first 5 characters of the SHA-1 hash of the password.
• Returns the response containing a list of hash suffixes and their breach counts.

get_password_leaks_count(hashes, hash_to_check)

• Parses the API response to find if the full hash of the password exists in the breach data.
• Returns the number of times the password was found in breaches.

pwned_api_check(password)

• Hashes the password using SHA-1 and splits it into the first 5 characters (first5_char) and the rest (tail).
• time.sleep(API_REQUEST_DELAY), a delay is added before making the API request to avoid rate limiting.
• Sends the first 5 characters to the API and checks if the tail exists in the response.
• Returns the breach count if found, or 0 if not.

3. Local Common Password Check

check_common_password(password)

• Opens the common_passwords.txt file and loads its contents into a set for fast lookups.
• Checks if the password exists in the set.
• Handles errors like missing or unreadable files gracefully by printing warnings and skipping the check.

4. Main Function

main(args)

• Accepts a list of passwords as command-line arguments.
• Prints a structured table header for the results.
• For each password:
  1. Strips whitespace to ensure clean input.
  2. Checks the local common password list:
     • If found, marks the password as "Common password" and advises changing it.
  3. Checks the HIBP API:
     • If found in breaches, marks the password as "Data breach" and displays the breach count.
  4. If neither check finds the password, marks it as "Secure password."
• Prints the results in a formatted table.
• Returns 0 for success or 1 if no passwords were provided.

---

5. Entry Point

if __name__ == '__main__':
    sys.exit(main(sys.argv[1:]))

• Executes the main function with command-line arguments (excluding the script name).
• Exits with the appropriate status code.

Example Execution

Command:

python passcheck.py password123 qwerty mysecurepassword

Output:

Password             | Status          | Details
------------------------------------------------------------
password123          | Common password | Found in common_passwords list. Consider changing it!

qwerty               | Common password | Found in common_passwords list. Consider changing it!

mysecurepassword     | Non-breached password | Not found in breach or common_passwords list.

Key Features

1. Local and API-based checks: Combines local file checks with an online API for comprehensive password evaluation.
2. Error handling: Gracefully handles missing files or API errors.
3. User-friendly output: Displays results in a structured table format.

Conclusion:

The script is designed to evaluate the security of passwords by checking against two sources: a local list of 1000 common passwords, AI-generated, and an external API, HIBP (Have I Been Pwned). The script is a useful tool for quickly assessing the security of passwords by combining checks against common passwords and known breach data. It's helpful for users who want to ensure their credentials are strong and have not been involved in past breaches.