The breached hashes under the first five characters of a password's SHA-1.

GET

/api/v1/auth/pwned/{prefix}

Errors

404 when this instance does not check passwords against the breach list, 400 for anything but five hex characters, 429 when this source is over its limit, 503 when the breach list is unreachable. A form treats the last as "no warning"; the check still runs on submit.

Path Parameters

prefix*string

The first five characters of the password's SHA-1, in hex, either case

Response Body

The breached suffixes under that prefix

application/json

response

The breached suffixes under one prefix.

suffixes*array<string>

The remaining 35 characters of every breached hash under the prefix, uppercase. The service's padding entries, which hide the real count, are removed, so any match here is real.

curl -X GET 'https://example.com/api/v1/auth/pwned/string'

{  "suffixes": [    "string"  ]}