# Have I been pwned?

**URL:** <https://discourse.julialang.org/t/have-i-been-pwned/5309>\
**Category:** General Usage\
**Created:** [August 9, 2017, 6:16pm UTC](https://discourse.julialang.org/t/have-i-been-pwned/5309 "2017-08-09T18:16:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![barche](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/barche/32/79_2.png) [@barche](https://discourse.julialang.org/u/barche)\
**Post date:** [August 9, 2017, 6:16pm UTC](https://discourse.julialang.org/t/have-i-been-pwned/5309/1 "2017-08-09T18:16:59Z")

</div>

Hi,

I wanted to write a Julia password checker following the news about a list of hacked passwords, posted here as a list of SHA1 hashes:

> **[Have I Been Pwned: Pwned Passwords](https://haveibeenpwned.com/Passwords)**
>
> Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

The code I came up with is this: (requires 6.2 GB RAM on the real password list)

```julia
using SHA

const N = 307_000_000

struct PWHash
  data::NTuple{20,UInt8}
end

PWHash(sha_hash) = PWHash((sha_hash...))
PWHash() = PWHash((fill(typemax(UInt8),20)...))

Base.isless(x::PWHash, y::PWHash) = (x.data < y.data)

tic()
hashes = fill(PWHash(), N)
t = toc()

println("Memory allocated")

tic()
open("pwned-passwords-1.0.txt") do f
  for (i,ln) in enumerate(eachline(f))
    hashes[i] = PWHash(hex2bytes(ln))
  end
end
t = toc()

println("File read")

pwhash = PWHash()
emptyhash = PWHash(sha1(""))
while pwhash != emptyhash
  println("enter password:")
  pwhash = PWHash(sha1(readline()))
  if !isempty(searchsorted(hashes, pwhash))
    println("You're pwned!")
  else
    println("You're safe, possibly")
  end
end

```

Of course I am certain this is already perfect and couldn’t possibly be improved upon ( 😉 ), except for a small detail: the `readline` echos back the password to the screen, is there any way to avoid that?

---

<div class="post-metadata">

**Author:** ![tkelman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tkelman/32/692_2.png) [@tkelman](https://discourse.julialang.org/u/tkelman)\
**Post date:** [August 10, 2017, 7:33am UTC](https://discourse.julialang.org/t/have-i-been-pwned/5309/2 "2017-08-10T07:33:07Z")

</div>

There are prompt and winprompt functions used in the LibGit2 bindings that have a password flag, which you can set to avoid echoing the typed password.

---

<div class="post-metadata">

**Author:** ![barche](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/barche/32/79_2.png) [@barche](https://discourse.julialang.org/u/barche)\
**Post date:** [August 10, 2017, 6:49pm UTC](https://discourse.julialang.org/t/have-i-been-pwned/5309/3 "2017-08-10T18:49:37Z")

</div>

Thanks, that works. Do you know where the echo comes from in the normal `readline`? I couldn’t find where this happens in the Julia code, it seems it would be more elegant to have a prompt function in Julia Base rather than having to rely on LibGit2 for this.

---

<div class="post-metadata">

**Author:** ![tkelman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tkelman/32/692_2.png) [@tkelman](https://discourse.julialang.org/u/tkelman)\
**Post date:** [August 12, 2017, 1:15am UTC](https://discourse.julialang.org/t/have-i-been-pwned/5309/4 "2017-08-12T01:15:36Z")

</div>

I don’t know, sorry. The existing prompt code isn’t actually LibGit2 specific or depending on that library at all, it just happened to be put there because that was where it needed to be used. It was recently moved to a different module on master.