1var passwordInput = document.getElementById("inputPassword") 2var passwordplain = ''; 3var lastpasschecked = ''; 4var lastrequestfinished = true; 5window.setInterval(function(){ 6 passwordplain = passwordInput.value; 7 if ((lastpasschecked !== passwordplain) && lastrequestfinished) { 8 9 if (passwordplain !== '') { 10 11 var sha1pass = SHA1(passwordplain); 12 sha1pass = sha1pass.toUpperCase(); 13 var subsha1pass = sha1pass.substring(5); 14 lastrequestfinished = false; 15 var xhttp = new XMLHttpRequest(); 16 xhttp.onreadystatechange = function() { 17 if (this.readyState == 4 && this.status == 200) { 18 lastrequestfinished = true; 19 var xhttpresponse = this.responseText; 20 if (xhttpresponse.indexOf(subsha1pass) !== -1) { 21 22 var passlist = xhttpresponse.split("\n"); 23 var pwnedcount = 0; 24 var timespell = 'times'; 25 for (var i = 0; i < passlist.length; i++) { 26 if (subsha1pass == passlist[i].split(":")[0]) { 27 pwnedcount = passlist[i].split(":")[1]; 28 if (passlist[i].split(":")[1] == 1){ timespell = "time"; } 29 } 30 } 31 32 document.getElementById("iscompromised").innerHTML = '<span style="color: #ff0000;">Oh no! This password was found <b>'+ pwnedcount + '</b> '+ timespell + ' in compromised passwords databases! You should change it immediately. Using a password that has been breached is extremely dangerous. <h4>If you are using this password on multiple websites, you should take the opportunity to start using different passwords for every website. Attackers can take the advantage of password reuse by automating login attempts on your account using breached emails and password pairs.</h4></span>'; 33 }else { 34 lastrequestfinished = true; 35 document.getElementById("iscompromised").innerHTML = '<span style="color: #339966;">Good news, your password has never been breached!</span>'; 36 } 37 }else { 38 if (this.readyState == 4) { 39 lastrequestfinished = true; 40 //document.getElementById("iscompromised").innerHTML = '<span style="color: #ff0000;">This password can\'t be verified right now...</span>'; 41 document.getElementById("iscompromised").innerHTML = ''; 42 } 43 } 44 }; 45 46 xhttp.open('GET', 'https://api.pwnedpasswords.com/range/' + sha1pass.substring(0, 5)); 47 xhttp.send(); 48 } 49 lastpasschecked = passwordplain; 50 } 51 52}, 2000); 53 54 55 56 57/** 58* 59* Secure Hash Algorithm (SHA1) 60* http://www.webtoolkit.info/ 61* 62**/ 63function SHA1 (msg) { 64 function rotate_left(n,s) { 65 var t4 = ( n<<s ) | (n>>>(32-s)); 66 return t4; 67 }; 68 function lsb_hex(val) { 69 var str=""; 70 var i; 71 var vh; 72 var vl; 73 for( i=0; i<=6; i+=2 ) { 74 vh = (val>>>(i*4+4))&0x0f; 75 vl = (val>>>(i*4))&0x0f; 76 str += vh.toString(16) + vl.toString(16); 77 } 78 return str; 79 }; 80 function cvt_hex(val) { 81 var str=""; 82 var i; 83 var v; 84 for( i=7; i>=0; i-- ) { 85 v = (val>>>(i*4))&0x0f; 86 str += v.toString(16); 87 } 88 return str; 89 }; 90 function Utf8Encode(string) { 91 string = string.replace(/\r\n/g,"\n"); 92 var utftext = ""; 93 for (var n = 0; n < string.length; n++) { 94 var c = string.charCodeAt(n); 95 if (c < 128) { 96 utftext += String.fromCharCode(c); 97 } 98 else if((c > 127) && (c < 2048)) { 99 utftext += String.fromCharCode((c >> 6) | 192); 100 utftext += String.fromCharCode((c & 63) | 128); 101 } 102 else { 103 utftext += String.fromCharCode((c >> 12) | 224); 104 utftext += String.fromCharCode(((c >> 6) & 63) | 128); 105 utftext += String.fromCharCode((c & 63) | 128); 106 } 107 } 108 return utftext; 109 }; 110 var blockstart; 111 var i, j; 112 var W = new Array(80); 113 var H0 = 0x67452301; 114 var H1 = 0xEFCDAB89; 115 var H2 = 0x98BADCFE; 116 var H3 = 0x10325476; 117 var H4 = 0xC3D2E1F0; 118 var A, B, C, D, E; 119 var temp; 120 msg = Utf8Encode(msg); 121 var msg_len = msg.length; 122 var word_array = new Array(); 123 for( i=0; i<msg_len-3; i+=4 ) { 124 j = msg.charCodeAt(i)<<24 | msg.charCodeAt(i+1)<<16 | 125 msg.charCodeAt(i+2)<<8 | msg.charCodeAt(i+3); 126 word_array.push( j ); 127 } 128 switch( msg_len % 4 ) { 129 case 0: 130 i = 0x080000000; 131 break; 132 case 1: 133 i = msg.charCodeAt(msg_len-1)<<24 | 0x0800000; 134 break; 135 case 2: 136 i = msg.charCodeAt(msg_len-2)<<24 | msg.charCodeAt(msg_len-1)<<16 | 0x08000; 137 break; 138 case 3: 139 i = msg.charCodeAt(msg_len-3)<<24 | msg.charCodeAt(msg_len-2)<<16 | msg.charCodeAt(msg_len-1)<<8 | 0x80; 140 break; 141 } 142 word_array.push( i ); 143 while( (word_array.length % 16) != 14 ) word_array.push( 0 ); 144 word_array.push( msg_len>>>29 ); 145 word_array.push( (msg_len<<3)&0x0ffffffff ); 146 for ( blockstart=0; blockstart<word_array.length; blockstart+=16 ) { 147 for( i=0; i<16; i++ ) W[i] = word_array[blockstart+i]; 148 for( i=16; i<=79; i++ ) W[i] = rotate_left(W[i-3] ^ W[i-8] ^ W[i-14] ^ W[i-16], 1); 149 A = H0; 150 B = H1; 151 C = H2; 152 D = H3; 153 E = H4; 154 for( i= 0; i<=19; i++ ) { 155 temp = (rotate_left(A,5) + ((B&C) | (~B&D)) + E + W[i] + 0x5A827999) & 0x0ffffffff; 156 E = D; 157 D = C; 158 C = rotate_left(B,30); 159 B = A; 160 A = temp; 161 } 162 for( i=20; i<=39; i++ ) { 163 temp = (rotate_left(A,5) + (B ^ C ^ D) + E + W[i] + 0x6ED9EBA1) & 0x0ffffffff; 164 E = D; 165 D = C; 166 C = rotate_left(B,30); 167 B = A; 168 A = temp; 169 } 170 for( i=40; i<=59; i++ ) { 171 temp = (rotate_left(A,5) + ((B&C) | (B&D) | (C&D)) + E + W[i] + 0x8F1BBCDC) & 0x0ffffffff; 172 E = D; 173 D = C; 174 C = rotate_left(B,30); 175 B = A; 176 A = temp; 177 } 178 for( i=60; i<=79; i++ ) { 179 temp = (rotate_left(A,5) + (B ^ C ^ D) + E + W[i] + 0xCA62C1D6) & 0x0ffffffff; 180 E = D; 181 D = C; 182 C = rotate_left(B,30); 183 B = A; 184 A = temp; 185 } 186 H0 = (H0 + A) & 0x0ffffffff; 187 H1 = (H1 + B) & 0x0ffffffff; 188 H2 = (H2 + C) & 0x0ffffffff; 189 H3 = (H3 + D) & 0x0ffffffff; 190 H4 = (H4 + E) & 0x0ffffffff; 191 } 192 var temp = cvt_hex(H0) + cvt_hex(H1) + cvt_hex(H2) + cvt_hex(H3) + cvt_hex(H4); 193 return temp.toLowerCase(); 194}
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.