Hashfirst
A single-file browser client for the public Have I Been Pwned API.
No API key, no account, no backend, no dependencies.
The name is the guarantee: your password is hashed before anything is sent.
Use it now
→ robgilm.github.io/hashfirst
Nothing to install, download, sign up for, or configure. Open the link and it works.
It runs entirely in your browser — there is no server behind it that could log what you
type. The page is served as static files from GitHub Pages, and every API call goes
straight from your browser to Have I Been Pwned.
What it does
| Tab | Endpoint | Key required |
|---|
| Check password | api.pwnedpasswords.com/range/ | no |
| Breach details | /api/v3/breach/{name} | no |
| All breaches | /api/v3/breaches | no |
Email search is deliberately absent. That endpoint (/api/v3/breachedaccount/) requires a
paid HIBP subscription and would mean sending your address to a server. Use
haveibeenpwned.com directly for that — it's free in the browser.
How the password check stays private
- You type a password. It never leaves the input field.
- The browser computes its SHA-1 locally via
crypto.subtle.
- Only the first 5 hex characters of that hash are sent to the range API.
- The API returns every hash suffix sharing that prefix — hundreds of them.
- Your suffix is matched against that list in your browser.
HIBP therefore never learns which password you checked. This is the
k-anonymity model.
Requests also set Add-Padding: true, so the response is a uniform size and its length
leaks nothing either.
Running your own copy
Optional — the hosted link above needs none of this. But it's one file, so self-hosting is
trivial if you'd rather not trust someone else's deployment.
Serve it over http://localhost or HTTPS. It needs a secure context, because
crypto.subtle is unavailable over file://:
python -m http.server 8899 --bind 127.0.0.1
Then open http://127.0.0.1:8899. Any static host works — it's one file with no build step.
If you open the file directly from disk, the page tells you so rather than failing silently.
Attribution
Breach data is sourced from Have I Been Pwned, created by
Troy Hunt, and is licensed under a
Creative Commons Attribution 4.0 International License.
The Pwned Passwords API carries no attribution requirement, but credit is given anyway.
This project is not affiliated with, endorsed by, or operated by Have I Been Pwned.
Inspired by — but sharing no code with — the
PwnyTrap CLI by David Watters.
License
MIT for this project's own code. The HIBP data it displays remains CC BY 4.0.
