Leaked Password Scan

Give it a list of passwords; it tells you which ones have already shown up in a data breach — and how many times — by checking them against Have I Been Pwned's corpus of ~14 billion exposed passwords.

Use it on the passwords that actually matter: service-account and shared credentials, admin logins, and your own personal passwords. A password that appears in the corpus is in attackers' wordlists today — it should be changed immediately, everywhere it's reused.

The catch you'd worry about — and why it isn't one

"Sending my passwords to a website to check if they leaked" sounds insane. It would be. This workflow never does that.

It uses k-anonymity, the same method HIBP's own password checker and 1Password/browser breach warnings use:

1. The password is SHA-1 hashed locally.
2. Only the first 5 hex characters of that hash are sent to the API.
3. The API replies with every hash suffix sharing those 5 characters (~800 of them) and their breach counts.
4. The match on the remaining 35 characters happens locally.

So the full password never leaves the machine — and neither does its full hash. The server can't tell which of the ~800 candidates you were asking about. The request also sends the Add-Padding header so the response size can't be used to fingerprint the query. No API key, no account, no cost.

What it does

1. scan — a runtimeenv task runs a short Python script (stdlib only — hashlib + urllib, no curl/jq/pip). It reads your password file, checks each line via k-anonymity, and prints a report. Passwords are masked in the report — only line number and length are shown — so the output is safe to email and keep in logs.
2. notify — the report is sent to you on your InTouch channel.

No AI, no per-run token cost — fully deterministic.

Example output

========================================================
  LEAKED PASSWORD SCAN  —  Have I Been Pwned
========================================================
Checked: 6   Pwned: 2   Clean: 4   Errors: 0

!! EXPOSED — these appear in known breaches. Change them now,
   and anywhere you reused them:

   line  length  times seen in breaches
   ----  ------  ----------------------
      3       8               3,861,493
      5      11                      17

   (passwords are masked — only line number and length shown)

Method: k-anonymity. Only the first 5 chars of each password's
SHA-1 hash were sent; the full password and hash stayed local.

Setup

1. Runtime environment

• python — auto-created by InTouch (runs python3). The script is stdlib-only (hashlib + urllib), so there's nothing else to install. No credential of any kind is required — the Pwned Passwords API is keyless.

2. Placeholders in workflow.yaml

3. Handle the password file safely

This file is the sensitive part — not the workflow. Lock it down and destroy it when you're done:

chmod 600 /path/to/passwords.txt   # owner read/write only
# ...run the workflow...
shred -u  /path/to/passwords.txt   # secure-delete (or 'rm -P' on macOS)

For ongoing monitoring of a stable set of service-account passwords, you can keep the file in place (mode 600) and schedule the workflow weekly.

Schedule

• On-demand — paste your passwords into the file, run, then shred the file.
• Weekly — keep a locked-down watch-list of service/shared passwords; the workflow re-checks them as new breaches are loaded into the corpus and alerts you the week a credential becomes exposed.

The workflow exits non-zero (code 2) when any password is found exposed, so you can branch alerting on the result if you wire it into a larger flow.

Notes & limits

• Found = bad. Not-found ≠ safe. Absence from HIBP means the password hasn't appeared in a known, loaded breach — it doesn't certify the password is strong or unique. A short common password not yet in the corpus is still weak.
• SHA-1 here is not a security claim — it's the index format HIBP publishes. The k-anonymity protocol, not the hash, is what protects your password in transit.
• Want to monitor email addresses / your domain for breach exposure instead of passwords? That's a different HIBP API (/breachedaccount) which requires a paid API key. Tell InTouch and it can generate a companion workflow that checks accounts and alerts on newly disclosed breaches.

Credits

Powered by Have I Been Pwned Pwned Passwords, by Troy Hunt. Data is licensed under the Open Data Commons Attribution License.