One GET request carrying five hex characters of a locally computed SHA-1. That is all a Have I Been Pwned check needs to send: one bucket out of about a million, matched locally, with padding masking response sizes. The other half of nurago's passwordpwned client is refusing to read a captive portal's HTML page as 'this password is safe'. https://tecnick.com/articles/nurago-passwordpwned/ #golang #security