Password Breach Checker

async function checkPasswordBreach(password) {
  // Step 1: SHA-1 hash the password locally
  const encoder = new TextEncoder();
  const data = encoder.encode(password);
  const hashBuffer = await crypto.subtle.digest('SHA-1', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('').toUpperCase();

  // Step 2: Extract first 5 characters (k-anonymity prefix)
  const prefix = hashHex.slice(0, 5);
  const suffix = hashHex.slice(5);

  // Step 3: Query HIBP API with only the prefix
  const response = await fetch(
    `https://api.pwnedpasswords.com/range/${prefix}`,
    { headers: { 'Add-Padding': 'true' } }
  );
  const text = await response.text();

  // Step 4: Check if our suffix appears in the results
  const lines = text.split('\n');
  for (const line of lines) {
    const [hashSuffix, count] = line.split(':');
    if (hashSuffix.trim() === suffix) {
      return {
        breached: true,
        count: parseInt(count.trim(), 10),
        message: `Found in ${count.trim()} breaches`
      };
    }
  }

  return { breached: false, count: 0, message: 'Not found in any known breaches' };
}

// Usage
const result = await checkPasswordBreach('MyP@ssw0rd123');
console.log(result);
// { breached: true, count: 2347, message: "Found in 2,347 breaches" }

async function checkMultiplePasswords(passwords) {
  const results = [];
  
  for (const password of passwords) {
    const encoder = new TextEncoder();
    const data = encoder.encode(password);
    const hashBuffer = await crypto.subtle.digest('SHA-1', data);
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('').toUpperCase();
    
    const prefix = hashHex.slice(0, 5);
    const suffix = hashHex.slice(5);
    
    const response = await fetch(
      `https://api.pwnedpasswords.com/range/${prefix}`,
      { headers: { 'Add-Padding': 'true' } }
    );
    const text = await response.text();
    
    let breachCount = 0;
    for (const line of text.split('\n')) {
      const [hashSuffix, count] = line.split(':');
      if (hashSuffix.trim() === suffix) {
        breachCount = parseInt(count.trim(), 10);
        break;
      }
    }
    
    results.push({
      password: password.slice(0, 3) + '*'.repeat(password.length - 3),
      breached: breachCount > 0,
      count: breachCount
    });
    
    // Rate limit: wait 1.5 seconds between requests
    await new Promise(r => setTimeout(r, 1500));
  }
  
  return results;
}