{"uid":"cap_fYA3bBlGzVwhwF_67QuKT","slug":"password-breach-check-k-anonymity-via-have-i-been-pwned-a051f053","name":"Password Breach Check (k-Anonymity via Have I Been Pwned)","description":"Have I Been Pwned Pwned Passwords via k-anonymity: only a 5-char SHA-1 prefix leaves the server. Returns pwned + occurrence count and a GO/HOLD/STOP. Password is not stored. Email breach lookup not offered.","url":"https://402.com.tr/api/x402/breach-check","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"pathParams":{"type":"object"},"queryParams":{"type":"object","required":["password"],"properties":{"password":{"type":"string","description":"Password to check"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_u5LfQKlGBb_vaVj-D3Opw","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a password has appeared in known data breaches using k-anonymity (only a 5-char SHA-1 prefix is sent), returning a GO/HOLD/STOP signal plus occurrence count.","exampleAgentPrompt":"Can you check if the password 'S3cur3P@ss2024!' has ever appeared in a known data breach — I want to know if it's safe to use or if it's already compromised?","exampleUseCases":[{"title":"Pre-signup password safety check","prompt":"Before I create my account, can you check whether the password 'CorrectHorseBatteryStaple' has ever shown up in a data breach? I want a GO, HOLD, or STOP recommendation."},{"title":"Security audit for employee passwords","prompt":"I'm reviewing password hygiene — can you check if 'Winter2023!' has been found in breach databases and tell me how many times it's been exposed?"},{"title":"Password manager vetting tool","prompt":"I'm deciding between a few passwords and want to pick the safest one — check whether 'Tr0ub4dor&3' has ever been leaked in a known breach and give me a risk signal."}],"resultDescription":"Returns a structured response containing: a GO/HOLD/STOP risk signal indicating password safety, a boolean indicating whether the password was found in breach data (pwned), and an integer occurrence count showing how many times it has appeared across known breach datasets. The password itself is never transmitted — only the first 5 characters of its SHA-1 hash leave the client.","failureModes":["Missing 'password' query parameter returns a 400 error","Network or upstream HIBP API unavailability returns a 5xx error","Empty or extremely short passwords may return unexpected results","Non-string or malformed input rejected by schema validation","Rate limiting or quota exhaustion on the upstream HIBP Pwned Passwords API"],"whenToPreferThis":"Choose this endpoint when you need a privacy-preserving breach check that uses k-anonymity so the actual password is never sent over the wire, and you want a structured GO/HOLD/STOP signal rather than a raw API response. Prefer it over direct HIBP API calls when you need a pay-per-call model with no API key management, or when operating within an x402 payment-enabled agentic workflow. Not suitable for email breach lookups — use a dedicated email breach endpoint for that.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:52:10.084Z","isFirstParty":false}