{"uid":"cap_Lqj0ojXuLB083mzRmht5T","slug":"pwned-password-check-c76924c1","name":"Pwned Password Check","description":"Check whether a password's SHA-1 hash appears in known breaches (Have I Been Pwned range API, k-anonymity, the full hash never leaves our server). Returns breach count.","url":"https://164.160.90.241.sslip.io/api/sec-haveibeenpwned-hash-lookup?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["hash"],"properties":{"hash":{"type":"string","description":"Uppercase or lowercase SHA-1 hex of the password"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-wVrnTWeOYJXkX8Dla3dL","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a password has appeared in known data breaches using the Have I Been Pwned k-anonymity range API, returning the breach count without exposing the full hash.","exampleAgentPrompt":"Can you check if the password 'Hunter2!' has ever appeared in a known data breach? Compute its SHA-1 hash and run it through the Have I Been Pwned k-anonymity lookup.","exampleUseCases":[{"title":"Pre-registration password safety check","prompt":"Before I let a user set their new account password, check if 'Sunshine2023' has ever shown up in a breach database — compute the SHA-1 and do a k-anonymity pwned check so the full hash stays private."},{"title":"Auditing stored passwords for compromise","prompt":"I'm auditing our password list — take the SHA-1 hash 8CB2237D0679CA88DB6464EAC60DA96345513964 and tell me how many times it's appeared in known data breaches via the Have I Been Pwned range lookup."},{"title":"Security policy enforcement for new passwords","prompt":"My app needs to reject passwords that are known to be breached. Check whether the password 'Password123' has been pwned and return the breach count so I can block it if it's been seen before."}],"resultDescription":"Returns the number of times the given password's SHA-1 hash has appeared across known breach datasets. A count of zero means the password was not found in any breach. A non-zero count indicates how many times it has been seen, allowing the caller to assess compromise risk. The k-anonymity model ensures only the first 5 characters of the SHA-1 hash are transmitted externally.","failureModes":["Invalid or malformed SHA-1 hash (not 40 hex characters) — returns an error response","Network timeout reaching the upstream Have I Been Pwned API — may return a 502 or 504","Rate limiting by the upstream HIBP range API — may return an error if called excessively","Non-hex characters in the hash parameter cause a bad request error","HIBP service outage results in unavailable response"],"whenToPreferThis":"Choose this endpoint when you need privacy-safe password breach checking using k-anonymity — meaning the full password hash never leaves your server and is never sent to a third party. Ideal for agents enforcing password security policies, auditing credential lists, or blocking compromised passwords at registration. Prefer this over direct HIBP API calls when you want a managed, paid-per-call service that handles the range API logic for you.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T00:41:36.158Z","isFirstParty":false,"canonicalSlug":"pwned-password-check-c76924c1"}