{"uid":"cap_-8vmEUcTfUifpnJHSXQeV","slug":"2s-password-exposure-check-have-i-been-pwned-via-k-anonymity-68dcba5f","name":"2s Password Exposure Check (Have I Been Pwned via k-anonymity)","description":"The (most) everything API: 575+ pay-per-call endpoints for AI agents — ground-truth data, a full AI gateway, and agent infrastructure (storage, queues, watchers). USDC via x402, no signup, no API keys, and upto billing: pay actual usage, not the quote.","url":"https://2s.io/api/security/password-exposure?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"sha1":{"type":"string","description":"Alternatively, the 40-hex SHA-1 of the password (client-side hashing = zero-knowledge)."},"password":{"type":"string","description":"Password to check (hashed server-side; only a 5-char SHA-1 prefix leaves)."}}},"responseSchema":null,"example":{"request":{"password":"TestPassword123!"},"response":{"data":{"ok":true,"items":[{"note":"This password appears in breach corpora 3,353 time(s) — do not use it.","count":3353,"source":{"url":"https://haveibeenpwned.com/API/v3#PwnedPasswords","license":"Pwned Passwords data is freely usable; queries are k-anonymous (only a 5-char SHA-1 prefix is sent).","provider":"Have I Been Pwned — Pwned Passwords (k-anonymity range API)"},"breached":true,"inputMode":"password","sha1Prefix":"382CA"}],"total":1,"source":{"url":"https://haveibeenpwned.com/API/v3#PwnedPasswords","license":"Pwned Passwords data is freely usable; queries are k-anonymous (only a 5-char SHA-1 prefix is sent).","provider":"Have I Been Pwned — Pwned Passwords (k-anonymity range API)"}},"meta":{"cost":{"usd":0.001,"tier":0},"caller":"x402","version":null,"endpoint":"security.password-exposure","settlement":{"txHash":"0x4e20c8e016b5b784d3a4ef67155d6df52ee82d59d29596ce436566cd6fef4717","network":"eip155:8453","success":true}}}},"exampleRequest":{"password":"TestPassword123!"},"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0025","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0025","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Av00t9_Y_JiisSTmF5Kjj","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0025","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a given password appears in known breach datasets using k-anonymous SHA-1 prefix lookup, returning breach count and status.","exampleAgentPrompt":"Can you check whether the password 'Sunshine2020!' has ever shown up in a data breach, and tell me how many times it's been seen in leaked databases?","exampleUseCases":null,"resultDescription":"Returns a JSON object with an ok flag, an items array (each with breached boolean, breach count, the SHA-1 prefix used, input mode, and a descriptive note), total count of results, and source metadata including the provider (Have I Been Pwned), license, and API URL.","failureModes":["Missing both password and sha1 fields — returns validation error","Invalid SHA-1 hash format (not 40 hex chars) — returns error","Network/upstream HIBP API unavailable — may return error or timeout","Payment failure via x402 — request not processed"],"whenToPreferThis":"Use this endpoint when you need to check a specific password or its SHA-1 hash against known breach datasets with k-anonymity (only a 5-char prefix is transmitted, preserving privacy). Prefer the sha1 input mode for zero-knowledge checks where the plaintext should never leave the client. Ideal for security audits, user onboarding validation, or credential hygiene checks.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:49:28.481Z","isFirstParty":false,"canonicalSlug":"2s-password-exposure-check-have-i-been-pwned-via-k-anonymity-68dcba5f"}