feat(hash): pwned-password check (Have I Been Pwned, k-anonymity)

[lyfuci]

What

A Pwned password check in the Hash tool: enter a password (text mode) and click Check to see whether it's appeared in known breach corpora — so you can avoid easily-cracked passwords. This is the rainbow-table-style "is this crackable?" check requested.

How — privacy-preserving by design

Uses the Have I Been Pwned: Pwned Passwords API with k-anonymity (src/lib/hibp.ts):

1. SHA-1 the password locally.
2. Send only the first 5 hex chars of the hash to …/range/{prefix} (a plain GET, no custom headers → a CORS simple request, no preflight).
3. Match the returned suffix list in-page and read the breach count.

The password itself never leaves the browser — the server only sees a 5-char prefix shared by thousands of hashes.

• Explicit-trigger only (a Check button), per the repo's no-silent-network rule (same pattern as IP Info / DNS). The result resets when the input is edited.
• Strips the textarea's trailing newline before checking; internal/leading spaces are preserved (passwords can contain them).
• Meaning-correct wording: "found in N known breaches" vs "not found in any known breach (not a strength guarantee)" — deliberately never says "safe"/"strong", since not-found ≠ strong.

Verification

• pnpm typecheck · pnpm lint · pnpm build — clean; 208 tests green.
• 5 unit tests with an injected fetch — including the FOUND case asserted on the real SHA-1 of password (5BAA6 / …68FD8), so the silent-failure bugs (lowercase hex, wrong slice, prefix-in-suffix — all of which look like "not found") can't pass.
• Real end-to-end call in the COEP cross-origin-isolated app via headless Chrome — this is the load-bearing check that CORS + COEP + CSP all permit it: crossOriginIsolated=true, HTTP 200, password → 52,256,179, a random string → 0; the UI transitions Checking… → the breach count.

EN + zh-CN strings.

🤖 Generated with Claude Code