Ttykuu

So I really have no idea how to better describe this than the title.

So I discovered this website called pwnedpasswords, where you can apparently check to see if your password's sha1 hash has been leaked somewhere. So I made a script to automate the process, here's my script:

#!/bin/bash

read -s -p "Input your password: " your_pw
echo
your_hash=$(printf "$your_pw"|sha1sum|tr '[:lower:]' '[:upper:]'|head -c40)
hash_head=$(printf "$your_hash"|head -c5)
hash_tail=$(printf "$your_hash"|tail -c35)

pwned_count=$(curl https://api.pwnedpasswords.com/range/$hash_head 2> /dev/null|grep "$hash_tail"|awk -F ':' 'print $2')
echo "Your password has been pwned $your_pw times"
echo "Your password has been pwned $pwned_count times"

And I used as a test password 1, and this is the output:

[me@my_compuuter aaa8]$ ./was_your_password_pwned.sh
Input your password:
Your password has been pwned 1 times
 timesassword has been pwned 197972

Notice how when I echo "Your password has been pwned $your_pw times"
it gives me the correct format ($your_pw is just the password itself), but when I echo "Your password has been pwned $pwned_count times" it gives me this weird format where it takes the times from the end and somehow overlaps it in the beginning... I have no clue what's going on...

Can somebody figure it out?

The list returned by that site has lines terminated by CR/LF. A CR (r) will move the caret/cursor to the beginning of the line:

printf 'good r times'
 times