1Password on Mastodon

5 characters- collision

Community Member

i know 1password used haveibeenpwned.

according the website "When you search Pwned Passwords
The Pwned Passwords feature searches previous data breaches for the presence of a user-provided password. The password is hashed client-side with the SHA-1 algorithm then only the first 5 characters of the hash are sent to HIBP per the Cloudflare k-anonymity implementation. HIBP never receives the original password nor enough information to discover what the original password was."

But if it only compares the first 5 characters, isnt there a great deal of collision, so just because it says my password was listed, does not mean it was pawned

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided


  • jvoskjvosk
    Community Member

    @pathfinder76 probability of a collision on the first 5 hex characters of a SHA-1 hash is 16^-5 or ~1 in 1 million. If haveibeenpwned says there's a collision, best to assume yes, you have been pwned.

  • Tertius3Tertius3
    Community Member
    edited January 31

    @pathfinder76 You didn't read the complete password checking description. The first 5 characters of the hash are sent to HIBP, then HIBP sends back every hash known from some breach that starts with these 5 characters. As far as I remember, it's about 5-30 hashes you're getting this way. This is then checked by some Javascript locally in your browser, and if one of these hashes match, it's reported. HIBP doesn't get notified which of the hashes actually matched or whether one matched at all.

  • Tertius3Tertius3
    Community Member

    It's equally safe. In no case the password is transmitted. I guess more foolproof is the indirect use via watchtower, because it's checking your whole password store and not just one password, and since you don't copy+paste passwords into some input field, it cannot happen you accidentally paste it to where it doesn't belong.

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file