{"uid":"cap_y2JmDkMbzuXCLmvO4ocsl","slug":"password-breach-check-k-anonymity-166211d7","name":"Password Breach Check (k-Anonymity)","description":"Check whether a password has appeared in known data breaches, using k-anonymity: the password is hashed locally and only a 5-character hash prefix is sent upstream, so the plaintext is never transmitted, logged or stored. Accepts a password, a SHA-1 hash or an NTLM hash. Returns compromised, breach_count and the hash prefix. Credential-exposure indicators, not a guarantee.","url":"https://api.agentstools.dev/breach/password","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"ntlm":{"type":"string","description":"Alternative input: a full 32-hex NTLM hash (MD4 cannot be computed here, so send the hash for the NTLM corpus)"},"sha1":{"type":"string","description":"Alternative input: a full 40-hex SHA-1 hash of the password (so the plaintext never leaves your side)"},"password":{"type":"string","description":"Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_vHz3080qNIUuHYTuQLCWX","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a password, SHA-1 hash, or NTLM hash has appeared in known data breaches using k-anonymity, returning a compromised flag and breach count without ever transmitting the plaintext.","exampleAgentPrompt":"Check if the password 'Hunter2!' has appeared in any known data breaches — use the k-anonymity method so the plaintext is never transmitted, and tell me if it's compromised and how many times it's shown up.","exampleUseCases":[{"title":"Password policy enforcement at signup","prompt":"When a new user sets their password during registration, check whether 'Spring2024!' has been found in any known data breaches and block it if it's compromised."},{"title":"Security audit of employee credentials","prompt":"I want to check if the password 'Companyname1' has ever appeared in a breach database — use the k-anonymity approach so the actual password never leaves our system, and tell me the breach count."},{"title":"Verifying a known SHA-1 hash from a threat feed","prompt":"I have a SHA-1 hash from a threat intelligence feed — '5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8' — can you check if this password hash shows up in breach data and how many times it's been seen?"}],"resultDescription":"Returns a JSON object with a 'compromised' boolean indicating whether the input appeared in known breach data, a 'breach_count' integer showing how many times it was found, and the 'hash_prefix' (first 5 characters of the SHA-1 hash) used for the k-anonymity lookup. These are credential-exposure indicators, not a definitive security guarantee.","failureModes":["Invalid or malformed hash format (not 40-hex for SHA-1 or 32-hex for NTLM) may return a validation error","Missing required 'input' body fields returns a 400 bad request","Network or upstream breach database unavailability may cause timeouts or 503 errors","NTLM hash corpus is separate and may have different coverage than SHA-1 corpus","A result of compromised=false does not guarantee the password is safe, only that it wasn't found in the indexed breaches"],"whenToPreferThis":"Choose this endpoint when you need a privacy-preserving credential breach check that uses k-anonymity so the plaintext password is never transmitted. It is ideal for agents enforcing password policies at sign-up, auditing credentials, or integrating breach-check into security workflows without the risk of exposing sensitive credentials to a third-party server. Prefer it over raw HIBP API calls when you want a simple, pre-packaged, agent-friendly interface with structured output including compromised status and breach count.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T19:06:53.488Z","isFirstParty":false}