class Unpwn

Unpwn checks passwords locally against the top one million passwords, as provided by the nbp project. Then, it uses the haveibeenpwned API to check proposed passwords against the largest corpus of publicly dumped passwords in the world.

Constants

VERSION

Attributes

offline[RW]

Set `offline` to true to disable requests to the haveibeenpwned.com API

max[R]

min[R]

request_options[R]

Public Class Methods

acceptable?(password) click to toggle source

Check if a password is not already published. To set options like `min`, `max`, or on the Pwned API check, create a new instance of your own.

# File lib/unpwn.rb, line 15
def acceptable?(password)
  new.acceptable?(password)
end

new(min: 8, max: nil, request_options: nil) click to toggle source

Set the options for an Unpwn instance. `request_options` will be passed verbatim to the `Pwned` library.

# File lib/unpwn.rb, line 24
def initialize(min: 8, max: nil, request_options: nil)
  raise ArgumentError if min && min < 8
  raise ArgumentError if max && max < 64

  @min = min
  @max = max
  @request_options = request_options || {}
end

Public Instance Methods

acceptable?(password) click to toggle source

Check if a password meets the requirements and is not pwned.

# File lib/unpwn.rb, line 34
def acceptable?(password)
  return false if min && password.size < min
  return false if max && password.size > max

  !pwned?(password)
end

bloom() click to toggle source

# File lib/unpwn.rb, line 53
def bloom
  @bloom ||= begin
    require "bloomer"
    require "bloomer/msgpackable"
    top = File.read File.expand_path("top1000000.msgpack", __dir__)
    Bloomer.from_msgpack(top)
  end
end

inspect() click to toggle source

# File lib/unpwn.rb, line 62
def inspect
  "<UnPwn bloomed=#{@bloom ? 'yes' : 'no'}>"
end

Also aliased as: to_s

pwned?(password) click to toggle source

Checks if a password is pwned, via bloom filter then `Pwned`.

# File lib/unpwn.rb, line 42
def pwned?(password)
  pwned = bloom.include?(password)

  unless self.class.offline
    require "pwned"
    pwned ||= Pwned.pwned?(password, request_options)
  end

  pwned
end

to_s()

Alias for: inspect