Deutsch

Honeypot64 – Check a password

Do attackers try this password? The check uses the passwords attackers entered at Honeypot64 sensors in the last 365 days (only passwords reported by several independent accounts).

Your password never leaves your browser. Your browser computes the SHA-1 hash of the password and sends only its first 5 characters to IPv64.net (k-anonymity, like “Have I Been Pwned”). The answer is a list of all known hash endings with this beginning – padded with random lines – and the comparison happens only here in your browser. IPv64.net learns neither the password nor its full hash nor the result. Nothing is stored or sent with a form.

What does the result mean? Found: attackers try exactly this password – do not use it, not even slightly modified. Not found: it is not on our list; this says nothing about whether it is strong.

For programs (login/sign-up pages): GET https://ipv64.net/api/v2/threat/passwords/range/<first 5 characters of SHA-1> – answer text, one line <remaining 35 characters>:<count> per entry (count 0 = padding), without an API key limited per IP, with an API key more generous.

Most used attacker passwords as a list: ipv64_passwords.txt · ipv64_passwords_sha1.txt · Statistics