Is rockyou password list in the Have I Been Pwned SHA1 hash list?

A couple of posts ago I wrote a tool in python to evaluate a password list for character sets that it uses and length.  While I was working on it, I wondered if the rockyou password list is in the SHA1 hash collection that you can download from Have I Been Pwned (HIBP).

Below is a bash script that I wrote.  To accomplish this I created a file with all of the SHA1 hashes for the rockyou password list.  Then I split the rockyou hash list into files that contained 3000 hashes in each file.  Then using egrep searched for the hashes in the HIBP list.  The hashes that were found were then saved in a file called zlist.txt.

#!/bin/bash

# Goal was to evaluate the cross-over between the rockyou list and the haveibeenpwned list as of 3/20/2019
# The rockyou list had to be converted from plain-text passwords to an upper-case SHA-1
# To accomplish the above task created a hashRockYou.py file and saved output as rockyouHashes.txt

# split -l 3000 rockyouHashes.txt   - This can add 3000 hashes to a egrep search
#        - Takes about 50 seconds per file...
#        - 

# Takes the list of files that are split out and creates an array of files
listFiles=(`ls -lha | awk '{print $9 " " }' | tr -d '\n' | sed 's/^.*xaa\s/xaa /'`)

# Iterates through the list
for i in ${listFiles[@]}
do
 # Outputs the date to verify the script continues to run
 date
 # Puts the 3000 hashes in a regular expression that can be put in egrep
 regex=`cat $i | sed 's/^/|/' | tr -d '\n' | sed 's/|/\^(?:/1' | sed 's/$/)/'`
 #echo "egrep -e \"$regex\" ../pwned-hashes-only.txt"
 # Run egrep with the generated regex of hashes against the haveibeenpwned list of SHA1
 # Create a file of the matches called zlist.txt
 egrep -e "$regex" ../pwned-hashes-only.txt >> zlist.txt
done

HIBP SHA1 List (22GB) contains 551,509,767
Rockyou SHA1 List (561MB) contains 14,344,391
Rockyou SHA1 found in HIBP list 14,333,886
Number of passwords not found in HIBP is 10,505