├── .github
└── FUNDING.yml
├── .gitignore
├── LICENSE.md
├── README.md
├── dist
└── index.js
├── index.html
├── jest.config.ts
├── package.json
├── pnpm-lock.yaml
├── src
├── cli.ts
└── index.ts
├── tests
└── index.test.ts
├── ui.css
└── ui.js
/.github/FUNDING.yml:
--------------------------------------------------------------------------------
1 | github: [mathiscode]
2 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | dist
2 | node_modules
--------------------------------------------------------------------------------
/LICENSE.md:
--------------------------------------------------------------------------------
1 | # MIT License
2 |
3 | Copyright (c) 2025 Jay Mathis
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | # @mathiscode/password-leak
4 |
5 | [](https://password-leak.vercel.app)
6 |
7 | [](https://www.npmjs.com/package/@mathiscode/password-leak)
8 | [](https://www.npmjs.com/package/@mathiscode/password-leak)
9 | [](https://github.com/mathiscode/password-leak/compare)
10 | [](https://github.com/mathiscode/password-leak/blob/master/LICENSE.md)
11 | [](https://snyk.io/test/github/mathiscode/password-leak?targetFile=package.json)
12 |
13 | ---
14 |
15 | - [Introduction](#introduction)
16 | - [How is this safe?](#how-is-this-safe)
17 | - [Installation](#installation)
18 | - [Usage in Browser](#usage-in-browser)
19 | - [Usage in Node.js](#usage-in-nodejs)
20 | - [With import/await](#with-importawait)
21 | - [With require/sync](#with-requiresync)
22 | - [Usage in Command Line](#usage-in-command-line)
23 | - [Development](#development)
24 |
25 | ---
26 |
27 | ## Introduction
28 |
29 | `password-leak` is a JavaScript module that can be used to determine if a password is compromised by checking with the [Have I Been Pwned API](https://haveibeenpwned.com/API/).
30 |
31 | ## How is this safe?
32 |
33 | Your passwords are **NEVER** transmitted to any other system. This library makes use of the [Have I Been Pwned API](https://haveibeenpwned.com/API/), which implements a [k-Anonymity Model](https://en.wikipedia.org/wiki/K-anonymity) so your password can be checked without ever having to give it to any other party.
34 |
35 | ## Installation
36 |
37 | `npm install @mathiscode/password-leak@latest`
38 |
39 | ## Usage in Browser
40 |
41 | ```html
42 |
43 |
44 |
50 | ```
51 |
52 | ## Usage in Node.js
53 |
54 | ### With import/await
55 |
56 | ```js
57 | import { isPasswordLeaked, checkPasswordStrength } from '@mathiscode/password-leak'
58 |
59 | const isLeaked = await isPasswordLeaked('myPassword')
60 | const strength = await checkPasswordStrength('myPassword')
61 | console.log('Is leaked?', isLeaked)
62 | console.log('Strength', strength)
63 | ```
64 |
65 | ### With require/sync
66 |
67 | ```js
68 | const { checkPasswordStrength, isPasswordLeakedSync } = require('@mathiscode/password-leak')
69 |
70 | isPasswordLeakedSync('myPassword', (error, isLeaked) => {
71 | if (error) throw new Error(error)
72 | console.log('Is leaked?', isLeaked)
73 | })
74 |
75 | const strength = checkPasswordStrength('myPassword')
76 | console.log('Strength', strength)
77 | ```
78 |
79 | ## Usage in Command Line
80 |
81 | Install globally:
82 |
83 | ```sh
84 | npm install -g @mathiscode/password-leak
85 | ```
86 |
87 | You can also use it without installing via npx:
88 |
89 | ```sh
90 | npx @mathiscode/password-leak myPassword
91 | ```
92 |
93 | You can then use it in two ways:
94 |
95 | 1. Interactive mode:
96 |
97 | ```sh
98 | password-leak
99 | ```
100 |
101 | 2. Direct mode:
102 |
103 | ```sh
104 | password-leak myPassword
105 | ```
106 |
107 | The command will:
108 |
109 | - Print whether the password has been compromised and its strength
110 | - Exit with status code 0 if the password is safe
111 | - Exit with status code 1 if the password is compromised or an error occurs
112 |
113 | ## Development
114 |
115 | ```sh
116 | # Clone the repository
117 | git clone https://github.com/mathiscode/password-leak.git
118 | cd password-leak
119 |
120 | # Use pnpm to install dependencies
121 | pnpm install
122 |
123 | # Build the project
124 | pnpm run build
125 |
126 | # Run the tests
127 | pnpm run test
128 |
129 | # Start the UI
130 | pnpm run ui # demo at https://password-leak.vercel.app
131 | ```
132 |
--------------------------------------------------------------------------------
/dist/index.js:
--------------------------------------------------------------------------------
1 | (()=>{function g(e){if(typeof e!="string")throw new TypeError("Expected a string");return e.replace(/[|\\{}()[\]^$+*?.]/g,"\\$&").replace(/-/g,"\\x2d")}var l=[{id:0,value:"Too weak",minDiversity:0,minLength:0},{id:1,value:"Weak",minDiversity:2,minLength:8},{id:2,value:"Medium",minDiversity:4,minLength:10},{id:3,value:"Strong",minDiversity:4,minLength:12}];var d=(e,s=l,n)=>{s[0].minDiversity=0,s[0].minLength=0;let i=e??"",a=[{key:"lowercase",regex:"[a-z]"},{key:"uppercase",regex:"[A-Z]"},{key:"number",regex:"[0-9]"},{key:"symbol",regex:n?`[${g(n)}]`:"[^a-zA-Z0-9]"}],t={};t.contains=a.filter(r=>new RegExp(`${r.regex}`).test(i)).map(r=>r.key),t.length=i.length;let o=s.filter(r=>t.contains.length>=r.minDiversity).filter(r=>t.length>=r.minLength).sort((r,h)=>h.id-r.id).map(r=>({id:r.id,value:r.value}));return Object.assign(t,o[0]),t};var c=globalThis.crypto,v=p;globalThis.isPasswordLeaked=p;globalThis.checkPassword=u;globalThis.checkPasswordStrength=f;async function u(e){return{strength:d(e),isLeaked:await p(e)}}function f(e){return d(e)}async function p(e){if(typeof e!="string")throw new Error("Password must be a string");let s=await c.subtle.digest("SHA-1",new TextEncoder().encode(e)),n=Array.from(new Uint8Array(s)).map(o=>o.toString(16).padStart(2,"0")).join(""),i=n.substring(0,5).toUpperCase();return(await(await fetch(`https://api.pwnedpasswords.com/range/${i}`)).text()).includes(n.substring(5).toUpperCase())}function S(e,s){if(typeof e!="string"){s(new Error("Password must be a string"),!1);return}c.subtle.digest("SHA-1",new TextEncoder().encode(e)).catch(n=>s(n,!1)).then(n=>{let i=Array.from(new Uint8Array(n)).map(t=>t.toString(16).padStart(2,"0")).join(""),a=i.substring(0,5).toUpperCase();fetch(`https://api.pwnedpasswords.com/range/${a}`).then(t=>t.text()).then(t=>s(null,t.includes(i.substring(5).toUpperCase()))).catch(t=>s(t,!1))})}})();
2 | //# sourceMappingURL=index.js.map
3 |
--------------------------------------------------------------------------------
/index.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 | Fast Secure Password Checker - Data Breach and Strength Information
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
Password Checker
15 |
Check if your password has been exposed in data breaches as well as its strength