Check breached passwords in C# and .NET 8

using System.Net;
using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text;

using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
var checker = new PasswordBreachChecker(http);

Console.Write("New password: ");
var password = ReadMasked();
var count = await checker.GetBreachCountAsync(password);
Console.WriteLine(count > 0
    ? $"Seen {count:N0} times in breach data. Choose another password."
    : "Not found in known breach data.");

static string ReadMasked()
{
    var sb = new StringBuilder();
    for (var key = Console.ReadKey(true); key.Key != ConsoleKey.Enter; key = Console.ReadKey(true))
        if (key.Key == ConsoleKey.Backspace && sb.Length > 0) sb.Length--;
        else if (!char.IsControl(key.KeyChar)) sb.Append(key.KeyChar);
    Console.WriteLine();
    return sb.ToString();
}

sealed class PasswordBreachChecker(HttpClient http)
{
    private readonly string _apiKey = Environment.GetEnvironmentVariable("FINOWL_API_KEY")
        ?? throw new InvalidOperationException("FINOWL_API_KEY is not set.");

    public async Task<long> GetBreachCountAsync(string password, CancellationToken ct = default)
    {
        for (var attempt = 1; attempt <= 3; attempt++)
        {
            using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.finowl.co/v1/breaches/password")
            {
                Content = JsonContent.Create(new { password }),
            };
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", _apiKey);
            using var response = await http.SendAsync(request, ct);

            // Exceptions carry the status only, never the password.
            switch (response.StatusCode)
            {
                case HttpStatusCode.OK:
                    var result = await response.Content.ReadFromJsonAsync<PasswordResult>(ct);
                    return result?.Count ?? 0;
                case HttpStatusCode.BadRequest:
                    throw new ArgumentException("Password is empty or over 4096 characters.");
                case HttpStatusCode.Unauthorized:
                    throw new InvalidOperationException("Finowl rejected FINOWL_API_KEY.");
                case HttpStatusCode.TooManyRequests:
                    await Task.Delay(response.Headers.RetryAfter?.Delta ?? TimeSpan.FromSeconds(5), ct);
                    continue;
                default:
                    throw new HttpRequestException($"Finowl returned {(int)response.StatusCode}.");
            }
        }
        throw new TimeoutException("Still rate limited after 3 attempts.");
    }
}

record PasswordResult(bool Breached, long Count);