Password Gate

Password Gate is a simple FastAPI-based API for checking whether a given password has appeared in known public data breaches using the Have I Been Pwned (HIBP) Pwned Passwords API.

How it works

• The core logic is in main.py.
• When a password is submitted, the app:
  1. Computes the SHA-1 hash of the password and converts it to uppercase.
  2. Splits the hash into a 5-character prefix and the remaining suffix.
  3. Calls the HIBP Pwned Passwords range API with the prefix.
  4. Compares the returned suffixes to the local suffix.
  5. If a match is found, the password is considered breached; otherwise, it is treated as safe.

API Endpoints

• GET /

  • Returns a welcome message and a brief usage hint.

• POST /check-password

  • Accepts a password string parameter.
  • If the password is found in the HIBP dataset, responds with HTTP 400 and a message indicating the password has appeared in a breach.
  • If not found, returns a JSON response indicating the password is safe to use.

Running the API

Install dependencies:

pip install -r requirements.txt

Run the application with Uvicorn (installed via fastapi[standard]):

uvicorn main:app --reload

Then open http://127.0.0.1:8000/docs in your browser to interact with the API via the automatically generated Swagger UI.