#!/usr/bin/env perl
# from youtube user zvpunry
# for a comment on https://www.youtube.com/watch?v=hhUb5iknVJs
# public domain (do whatever you want with it)
use warnings;
use strict;
use autodie;

use HTTP::Request;
use LWP::UserAgent;
use Digest::SHA qw(sha1_hex);

if (scalar(@ARGV) < 1) {
    die("Usage: $0 password [password ...]");
}

for (my $i = 0; $i < scalar(@ARGV); $i++) {
    my $sha1 = sha1_hex($ARGV[$i]);
    $sha1 =~ m/^(.{5})(.*)$/;
    my $prefix = $1;
    my $suffix = $2;
    my $request = HTTP::Request->new(GET => "https://api.pwnedpasswords.com/range/$prefix");
    my $ua = LWP::UserAgent->new(agent => "not pwned.py");
    my $response = $ua->request($request);

    if (! $response->is_success()) {
        die "failed to check password number ". ($i+1). ": ". $response->status_line;
    }

    if ($response->decoded_content =~ m/\b$suffix:(\d+)\b/is) {
        print "password ".($i+1)." pwned $1 times\n";
    }
    else {
        print "password ".($i+1)." not in this list, but this doesn't mean it's not pwned\n";
    }

}