'','leakcheck_key'=>'','monitor'=>false]); $output=''; if($_SERVER['REQUEST_METHOD']==='POST'){ csrf_validate(); $a=$_POST['action']??''; if($a==='save'){ $cfg['hibp_key']=trim($_POST['hibp_key']??''); $cfg['leakcheck_key']=trim($_POST['leakcheck_key']??''); $cfg['monitor']=!empty($_POST['monitor']); bg_write_json('identityleak.json',$cfg); bg_flash('success','API keys and monitor saved.'); bg_redirect('identityleak.php'); } elseif($a==='email'){ $email=trim($_POST['email']??''); if(!filter_var($email,FILTER_VALIDATE_EMAIL)) $output='Invalid email.'; elseif(!$cfg['hibp_key']) $output='Configure a HIBP API key to query email breaches.'; else { $res=bg_http_get('https://haveibeenpwned.com/api/v3/breachedaccount/'.rawurlencode($email).'?truncateResponse=false',['hibp-api-key: '.$cfg['hibp_key']]); $output='HIBP HTTP '.$res['code']."\n".($res['body']?:$res['error']); } } elseif($a==='password'){ $pwd=$_POST['password']??''; if($pwd==='') $output='Password is empty.'; else { $sha=strtoupper(sha1($pwd)); $prefix=substr($sha,0,5); $suffix=substr($sha,5); $res=bg_http_get('https://api.pwnedpasswords.com/range/'.$prefix); $count=0; if($res['body']) foreach(explode("\n",$res['body']) as $line){ [$s,$c]=array_pad(explode(':',trim($line),2),2,'0'); if($s===$suffix){$count=(int)$c; break;} } $output=$count>0 ? "Password found in public datasets: $count occurrences." : 'Password not found in the HIBP k-anonymity dataset.'; } }} include 'includes/header.php'; include 'includes/sidebar.php'; ?>

Identity breach check

Check email on HIBP, check passwords with k-anonymity and configure LeakCheck.

Check breaches
The full password is not sent to HIBP: the SHA-1 prefix is used.
API and monitor
>
Result