Security · Beginner
SafeKey: Password Strength and Breach Checker
Build a tool that scores password strength and checks if a password leaked using the k-anonymity range API, exposing nothing.
SafeKey is a command-line tool that evaluates password strength using established heuristics and checks whether a password has appeared in known data breaches without ever sending the password or its full hash over the network. You hash the password locally with SHA-1, send only the first five characters of that hash to the Have I Been Pwned Range API, and compare the returned suffix list entirely on the client side. The result is a practical demonstration of the k-anonymity privacy model that protects real user credentials during security audits.
What you build
- Score password strength on a 0 to 4 scale based on length, character variety, and common patterns
- Check any password against the Have I Been Pwned breach database without transmitting the full hash
- Display the breach count if the password has been seen in previous leaks
- Accept input from the command line or an interactive prompt with masked characters
- Emit a colored, human-readable verdict (Safe, Weak, Breached) in the terminal
- Provide a --batch flag to check a newline-delimited file of passwords and write a CSV report
What it teaches
- K-anonymity: how partial-hash prefix queries protect sensitive data in transit
- SHA-1 hashing with Python's hashlib and why cryptographic hash properties matter here
- Structuring a CLI application with Typer including argument parsing and subcommands
- Writing testable pure functions first, then composing them into a CLI interface
- Making unauthenticated HTTP requests with the requests library and handling rate limits gracefully
- Password strength heuristics and common pitfalls in naive strength scoring
How it works
- 1
User enters password
↓ Input never leaves the process
- 2
SHA-1 hash computed locally
- hashlib.sha1(password.encode())
- 3
First 5 hex chars sent to HIBP Range API
↓ k-anonymity: server never sees the full hash
- 4
API returns matching suffixes + counts
↓ Remaining 35 chars compared client-side
- 5
Verdict displayed
- Breach count
- Strength score
- Colored terminal output
Sign in to open the build guide
Free account. Get the step-by-step build and every resource link.
Take it further
- Add a password generator command that produces cryptographically random passphrases and immediately checks them against HIBP before printing
- Wrap the tool in a minimal FastAPI endpoint so other services can POST a password and receive a JSON verdict, using the same breach and strength modules without modification
- Cache HIBP range responses on disk with a configurable TTL to reduce API calls during batch runs
