https://github.com/nbaars/pwnedpasswords4j
A Java client for checking a password against pwnedpasswords.com using the `Searching by range` API For more details see: https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange
https://github.com/nbaars/pwnedpasswords4j
haveibeenpwned java passwords security-tools spring-boot
Last synced: 6 months ago
JSON representation
A Java client for checking a password against pwnedpasswords.com using the `Searching by range` API For more details see: https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange
- Host: GitHub
- URL: https://github.com/nbaars/pwnedpasswords4j
- Owner: nbaars
- License: other
- Created: 2018-03-07T12:04:27.000Z (over 7 years ago)
- Default Branch: main
- Last Pushed: 2021-12-01T21:47:23.000Z (almost 4 years ago)
- Last Synced: 2025-02-04T17:52:05.078Z (8 months ago)
- Topics: haveibeenpwned, java, passwords, security-tools, spring-boot
- Language: Java
- Size: 46.9 KB
- Stars: 6
- Watchers: 2
- Forks: 1
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project
README
# Java client for pwnedpasswords.com
[](https://travis-ci.org/nbaars/pwnedpasswords4j)
[](https://codeclimate.com/github/nbaars/pwnedpasswords4j/maintainability)
[](https://sonarcloud.io/dashboard/index/com.github.nbaars%3Apwnedpasswords4j-parent)
[](https://sonarcloud.io/dashboard/index/com.github.nbaars%3Apwnedpasswords4j-parent)
## Introduction
A Java client for checking a password against pwnedpasswords.com using the `Searching by range` API
For more details see: https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange
__News: Artifacts are available through Maven Central__
## Pure Java client
The artifact `client` can be used in a standalone Java program and does not rely on Spring Boot
To use the checker you need to add the following library to the `pom.xml`:
```
com.github.nbaars
pwnedpasswords4j-client
1.1.0
```
In the code you can check a password as follows:
```
PwnedPasswordChecker checker = PwnedPasswordChecker.standalone("My user agent")
boolean result = checker.check("password");
//OR for non blocking:
CompletableFuture result = checker.asyncCheck("password");
```
The user-agent is necessary to specify as described in the API description at haveibeenpwned.com.
## Spring Boot autoconfigure
For Spring Boot there is an autoconfigure module, to use this use the following dependency inside your project:
```
com.github.nbaars
pwnedpasswords4j-spring-boot-starter
1.0.1
```
In the application.properties you should add:
```
pwnedpasswords4j.user_agent=Testing # Required as described in the documentation of haveibeenpwned.com API
pwnedpasswords4j.url=https://api.pwnedpasswords.com/range/ # Optional
```
Wire up the checker as follows:
```
@Autowired
private PwnedPasswordChecker checker;
...
public void signup() {
boolean result = checker.check("password");
//or for non-blocking use:
CompletableFuture result = checker.asyncCheck("password");
}
```
As an example see the demo project:
```
@RestController
public class SignupController {
@Autowired
private PwnedPasswordChecker checker;
@PostMapping
public ResponseEntity> login(@RequestBody Login login) {
if (checker.check("password")) {
return ResponseEntity.badRequest().body("Consider changing your password");
}
return ResponseEntity.ok().build();
}
}
```
## Releasing
This is a manual process for now, make sure the GPG keys are in place
```
mvn clean deploy -Prelease
```
Go to `https://oss.sonatype.org/#stagingRepositories` and search the uploaded bundle, click `Close` wait for
all the rules to finish and click `Release`.