Two billion passwords from past data breaches are catalogued in Troy Hunt’s Have I Been Pwned. Checking a password against them, without ever exposing that password, turns out to be entirely possible from Access – no API key, no external runtime, and no library references to break.

Eight prompts into a session with Claude, PJ had a working module, a demo form and a build document. Then he tested it, and it returned nothing at all.

This session covers both halves of that story. The technical half is a complete, native VBA password-checker built from an empty database: all hashing in VBA, a privacy model that prevents the password leaving the machine, and a live demo – plus why the service costs nothing to run, and why the 70 GB offline corpus is stale before you’ve finished downloading it.

The other half is how it was built. He’ll show how he wrangled the AI, including a pushback on framing, and got a better, working, solution. Oh, and the solitary bug: a single VBA character, misdiagnosed twice by the AI, found only by running the code. AI was genuinely useful, but on its own it was insufficient to fully solve the problem.