Checking Pwned Passwords manually

pwned-passwords.sh

# Get the SHA-1 hash of your password. Here, we use `cat` to enter it securely
# so that it doesn't end up in shell history. (Type the password, then Enter,
# then ctrl-D to finish.)

$ cat | tr -d '\n' | sha1sum 
hunter2
f3bbbd66a63d4bf1747940578ec3d0103530e21d  -

# Split the hash digest into the first 5 and last 35 characters. You'll query
# the Pwned Passwords API for the prefix, then check if the suffix is in the
# results that come back.

$ curl -sS https://api.pwnedpasswords.com/range/f3bbb | grep -i d66a63d4bf1747940578ec3d0103530e21d
D66A63D4BF1747940578EC3D0103530E21D:23864

# We got a result, so it was in the DB! In fact, it was in there 23864 times.
# If result is empty, it wasn't in the DB. But check your methods first
# with a known-bad password so that you know you didn't just flub something.