Package: pass-audit
pass auditApassextension for auditing your password repository.Descriptionpass auditis a password-store extension for auditing your password repository.
Passwords will be checked against the Python implementation of Dropbox'zxcvbnalgorithm and Troy Hunt'sHave I Been PwnedService.
It supports safe breached password detection fromhaveibeenpwned.comusing aK-anonymitymethod. Using this method, you do not need to
(fully) trust the server that stores the breached password. You should read thesecurity considerationsection for more information.Usageusage: pass audit [-h] [-V] [-n NAME] [-v | -q] [pass-names]

 A pass extension for auditing your password repository. It supports safe
 breached password detection from haveibeenpwned.com using K-anonymity method,
 duplicated passwords, and password strength estimaton using zxcvbn.

positional arguments:
  pass-names            Path(s) to audit in the password store, If empty audit the full store.

options:
  -h, --help            show this help message and exit
  -V, --version         Show the program version and exit.
  -n NAME, --name NAME  Check only passwords with this filename
  -v, --verbose         Set verbosity level, can be used more than once.
  -q, --quiet           Be quiet.

More information may be found in the pass-audit(1) man page.Seeman pass-auditfor more information.ExamplesAudit a subfolder for pwned passwordspass audit goodpasswords/
(*) None of the 7 passwords tested are breached.
 .  But it does not means they are strong.pass audit pwnedpasswords/
 w  Password breached: password from Password/pwned/5 has been breached 3303003 time(s).
 w  Password breached: correct horse battery staple from Password/pwned/2 has been breached 2 time(s).
[x] Error: 7 passwords tested and 2 breached passwords found.
 .  You should update them with 'pass-update'.Security considerationThis program uses K-anonymity to retrieve the knowledge of breached passwords
from HIBP server. K-anonymity applied to breached password check on an untrusted
remote server is a recent cryptographic approach. It means only the first five
characters of the SHA1 hash of your password is sent to the server. It offers
decent anonymity; nevertheless, it is not an entirely secure solution.More reading:https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/InstallationRequirementspass 1.7.0or greater.Python 3.6+python3-setuptoolsto build and install it.python3-requests(apt install python3-requestsorpip3 install requests)python3-zxcvbn(pip3 install zxcvbn)ArchLinuxpass-auditis available in theArch User Repository.yay-Spass-audit# or your preferred AUR install methodDebian/Ubuntupass-auditis available under my own debian repository with the package namepass-extension-audit. Both the repository and the package are signed with
my GPG key:06A26D531D56C42D66805049C5469996F0DF68EC.wget-qO-https://pkg.pujol.io/debian/gpgkey|sudoapt-keyadd-echo'deb [arch=amd64] https://pkg.pujol.io/debian/repo all main'|sudotee/etc/apt/sources.list.d/pkg.pujol.io.list
sudoapt-getupdate
sudoapt-getinstallpass-extension-auditFreeBSD# install the binary packagepkginstallpy36-pass-audit# or build it using the ports treemake-C/usr/ports/security/py-pass-auditinstallcleanUsing pippipinstallpass-auditFrom gitgitclonehttps://github.com/roddhjav/pass-audit/cdpass-audit
python3setup.pyinstallStable versionwgethttps://github.com/roddhjav/pass-audit/releases/download/v1.2/pass-audit-1.2.tar.gz
tarxzfpass-audit-1.2.tar.gzcdpass-audit-1.2
python3setup.pyinstallReleasesand commits are signed using06A26D531D56C42D66805049C5469996F0DF68EC.
You should check the key's fingerprint and verify the signature:wgethttps://github.com/roddhjav/pass-audit/releases/download/v1.2/pass-audit-1.2.tar.gz.asc
gpg--recv-keys06A26D531D56C42D66805049C5469996F0DF68EC
gpg--verifypass-audit-1.2.tar.gz.ascLocal installAlternatively, from git or a stable version you can do a local install with:cdpass-audit
python3setup.pyinstall--userRemember to setPASSWORD_STORE_ENABLE_EXTENSIONStotruefor the local
extension to be enabled.ContributionFeedback, contributors, pull requests are all very welcome.ContributorsTobias Girstmair(zxcvbn)LicenseCopyright (C) 2018-2022  Alexandre PUJOL and Contributors

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.