haveibeenpwned.ps1 - Check pwnage of password.

README.md

haveibeenpwned.ps1 - Check pwnage of password.

This script checks a password is registered or not in Pwned Password. To keep secret on http request, the password will be encrypted with SHA1 hash.

Usage

haveibeenpwned.bat

or

powershell.exe -ExecutionPolicy RemoteSigned .\haveibeenpwned.ps1

License

The MIT license.

References

• Validating Leaked Passwords with k-Anonymity

Relations

• Have I been pwned
• Gist / kou1okada / haveibeenpwned.sh

haveibeenpwned.bat

@ECHO OFF
powershell.exe -ExecutionPolicy RemoteSigned %~dp0haveibeenpwned.ps1

haveibeenpwned.ps1

# haveibeenpwned.ps1 - Check pwnage of password.
# Copyright 2026 (c) Koichi OKADA. All rights reserved.
# This script is distributed under the MIT license.

&{
  $secpw = Read-Host Password -AsSecureString
  $pw = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secpw))

  $stringAsStream = [System.IO.MemoryStream]::new()
  $writer = [System.IO.StreamWriter]::new($stringAsStream)
  $writer.Write($pw)
  $writer.Flush()
  $stringAsStream.Position = 0

  $sha1 = Get-FileHash -InputStream $stringAsStream -Algorithm SHA1 |% Hash

  $proxy = &{$uri=$Args[0]; [System.Net.WebRequest]::GetSystemWebProxy().GetProxy($uri).AbsoluteUri |% {if ($_ -eq $uri) {"--noproxy", "*"} else {"--proxy", $_}}} "https://google.com/"
  $pwned = curl.exe $proxy -s "https://api.pwnedpasswords.com/range/$($sha1.Substring(0,5))" | sls $sha1.Substring(5)
  if ("$pwned" -ne "") {$result = "$($sha1.Substring(0,5))$pwned"} else {$result = ""}

  "SHA-1   : $sha1"
  "Pwned   : $result"
}