Finding the password

I have a text file with 60,000 passwords (one password per line). I seem to have lost my password in this file. Can you help me find it?

How to play

1. Create a new user by choosing a username below.
2. On your user page, click "Get your passwords.txt" to get your personal list of passwords.
3. Check if a password is the one I lost by checking this website with the target password in the URL following this template:

   https://challenge.hsiao.dev/u/{username}/check/{password}

   where username is your username and password is the password you are checking.
   For example, if my username was john and I wanted to check password asdf, the URL would be https://challenge.hsiao.dev/u/john/check/asdf.
4. If the password is correct, you'll see true, and if it is incorrect, you will see false.
5. Seeing true means you found the password, but you're not done! Return to your user page, which lives at:

   https://challenge.hsiao.dev/u/{username}

   For example, if your username was john, your user page would be https://challenge.hsiao.dev/u/john. Enter the password you found in the confirmation box there. The challenge only counts as solved once you confirm the password.

Rules

• No using AI to solve the problem. The purpose of this is education! Feel free to consult the web and AI to learn, but do not let an AI rob you of the learning experience.
• No sharing a solution with each other, everyone has to do their own work, but you're free to collaborate.
• If you can solve it, you have to share with me what you did, along with some reflection about the challenge (e.g., what you learned, what was hard, what was surprising).
• Only use the url with your own name in it, don't impersonate others.
• There is no limit to how many times you can try. If you want to completely restart, make a new user.

Want an extra challenge?

Finding the password once is satisfying. Finding it fast is a different game entirely. The leaderboard below tracks how long every solve takes, from joining the challenge until the password is confirmed on your user page. Every guess counts as an attempt, whether it goes through the check URL or the confirmation box, so a sloppy script that keeps guessing after it finds the password keeps inflating your attempt count. So here's the real question: could you build a solution that finds the password for a brand-new user in under five minutes? What about under two minutes? Climb to the top of the board and find out.

Let's go!

Leaderboard

All players