hibp-go

Go client for checking breached passwords using HaveIBeenPwned's k-Anonymity API.

Features

• Standard library only (crypto/sha1, net/http, bufio).
• Implements k-Anonymity: only the first 5 hexadecimal characters of the SHA-1 hash are sent over the network. The password never leaves your application.
• Sends Add-Padding: true to prevent network packet size inspection.
• Returns breach occurrence count alongside a boolean status.
• Streams responses line-by-line with bufio.Scanner to avoid buffering large payloads in memory.

Installation

go get github.com/fumbledlol/hibp-go

Usage

Check password

package main

import (
	"context"
	"fmt"
	"log"

	"github.com/fumbledlol/hibp-go"
)

func main() {
	pwned, count, err := hibp.Check(context.Background(), "password123")
	if err != nil {
		log.Fatal(err)
	}

	if pwned {
		fmt.Printf("Password appeared in %d breaches.\n", count)
	} else {
		fmt.Println("Password not found in breaches.")
	}
}

Validate during signup

func ValidatePassword(ctx context.Context, password string) error {
    pwned, count, err := hibp.Check(ctx, password)
    if err != nil {
        return nil
    }

    if pwned && count > 10 {
        return fmt.Errorf("password appears in %d known breaches, choose another", count)
    }

    return nil
}

Reusable client

client := hibp.New(
    hibp.WithUserAgent("auth-service/1.0"),
    hibp.WithHTTPClient(httpClient),
)

pwned, count, err := client.Check(ctx, "user-secret")

License

MIT