Check how many times a password has been pwned according the the pwnedpasswords.com API without sending the password over the network. Based from https://github.com/detroitenglish/haveibeenpwned-zxcvbn-lambda-api

pwned.php

<?php

/**
 * Check how many times a password has been pwned
 * according the the pwnedpasswords.com API
 * without sending the password over the network
 *
 * @param String $password
 * @return Int
 */
function get_pwned_count(String $password){
  $endpoint = 'https://api.pwnedpasswords.com/range/';

  // Generate Hash and split into segments
  $hash = strtoupper(hash('sha1', $password));
  $prefix = substr($hash, 0, 5);
  $suffix = substr($hash, 5);

  // Get Results for it
  $res = curl($endpoint.$prefix);

  $exists = stripos($res, $suffix);

  if($exists === false){
    return 0;
  }

  $end = substr ( $res, $exists );
  $eol = stripos( $end, "\r\n"  );
  $row = substr ( $end, 0, $eol );

  return (int)explode(':', $row)[1];
}

/**
 * Do your Curly Request
 *
 * @param String $url
 * @return String
 */
function curl(String $url){
  $ch = curl_init();
  $options = [
      CURLOPT_SSL_VERIFYPEER => true,
      CURLOPT_RETURNTRANSFER => true,
      CURLOPT_URL            => $url
  ];

  curl_setopt_array($ch, $options);
  $data = curl_exec($ch);
  curl_close($ch);
  return $data;
}