Check a password against pwnedpasswords.com using k-anonymity

checkpw.sh

checkpw() {
  local pw sha shortsha suffixsha breachcount

  read -srp '> ' pw
  sha="$(echo -n "$pw" | sha1sum | cut -d' ' -f1)"
  shortsha="$(echo -n "$sha" | cut -c-5)"
  suffixsha="${sha#$shortsha}"

  breachcount="$(curl -s https://api.pwnedpasswords.com/range/$shortsha | grep -i $suffixsha | cut -d':' -f2)"

  if [ -z $breachcount ]; then
    printf '\e[0;32mNot compromised\n\e[0m'
  else
    printf '\e[0;31mCOMPROMISED: found %s times\n\e[0m' "$breachcount"
  fi

  unset pw
}