learn by doing
ENESUK
All challenges

Challenge 16

Has My Password Leaked?

Build a form that tells you whether a password has appeared in a known data breachA leak of a website's user database, often including passwords, which attackers then try on other sites. – without the password ever leaving your n8n.

BeginnerComplexity:Time: 20–30 min

Your task

Give people a simple form where they type a password and learn whether it has shown up in a known data breachA leak of a website's user database, often including passwords, which attackers then try on other sites., and how many times. Never send the password itself anywhere, and never save it.

Your bonus task

Turn the form into a sign-up form with an email address. If the password has leaked, say how many times and ask for another one. If it is clean, save the email and a hashA fixed-length fingerprint computed from text. The same input always gives the same hash, but the hash cannot be turned back into the text. of the password – never the password – in a Data Tablen8n's built-in table for storing rows inside your workspace, without an external database. and confirm the account.

Example use cases

  • An IT team that lets colleagues check a password before they use it anywhere.
  • A sign-up form that refuses passwords already found in data breaches.
  • Any check against an external service where the raw data must stay private.

Before you start

  1. 01

    Sign up for n8n Cloud or open your n8n workspace. No other account or key is needed.

  2. 02

    The check uses the Pwned Passwords API from Have I Been Pwned. It is free, needs no key and works by k-anonymity: you send only the first five characters of the password's SHA-1 hash to https://api.pwnedpasswords.com/range/XXXXX and get back every matching hash suffix with its count. Test with the password `password` – seen tens of millions of times – and with a long random string, which should return no match.

  3. 03

    For the bonus, create a Data Table named accounts with the columns email and password_hash (both text).

  4. 04

    In the workflow's Settings, set Save successful production executions to Do not save, so the form input is not kept in your execution history.

What the workflow must do

  1. 01

    Typing a leaked password such as `password` shows a result page saying it has appeared in breaches, with the number of times (more than 50 million); a long random password shows that no breach contains it.

  2. 02

    The execution shows that the request to Have I Been Pwned contains only the first five characters of the hashA fixed-length fingerprint computed from text. The same input always gives the same hash, but the hash cannot be turned back into the text., and no node after the hashing step still carries the password.

  3. 03

    Bonus: with a clean password, the accounts Data Tablen8n's built-in table for storing rows inside your workspace, without an external database. gets a new row with the email and a SHA-256A stronger hashing algorithm, used in the bonus for the stored fingerprint. hashA fixed-length fingerprint computed from text. The same input always gives the same hash, but the hash cannot be turned back into the text., never the password; with a leaked password, nothing is saved and the form asks for another one.

Solution

See the workflow challenge answer

Reveal the completed workflow only when you are ready to compare it with your own.

Submit as solved

Ready to submit?

Submit when your team has a working workflow to demonstrate.

Solution

Reveal the workflow solution?

This will show the completed workflow for this challenge. Are you sure you want to continue?

Mentor review

Find a mentor and ask them to review.

Show them your working workflow. Once they approve it, collect the balloon for this challenge.

Start next challenge