Free APIDev ToolsNo keyOfficial
Have I Been Pwned — Pwned Passwords
Check passwords against billions of breaches with k-anonymity; no key needed
The Pwned Passwords range API from Have I Been Pwned lets you check whether a password has appeared in known breaches without ever sending the password. You SHA-1 hash the password locally, send only the first 5 hex chars, and the API returns all matching hash suffixes plus how many times each was seen. This k-anonymity model keeps the password private. Unlike HIBP's breach-search APIs, this endpoint is fully free and keyless.
Free tier
Free, no key, no rate limit (the breach-account search API is a separate paid product requiring a key)Rate limits
No rate limit on the Pwned Passwords range endpoint per HIBPAuth
No keyBase URL
https://api.pwnedpasswords.comWhat you'd build with it
- Block compromised passwords at signup without leaking them
- Audit a user store against known breaches safely
- Add a 'this password has been seen N times' warning to a form
- Build a credential-hygiene check into an onboarding skill
Key endpoints
- GET
/range/{first5OfSHA1}Returns SHA-1 suffixes + breach counts for the given prefix
Members
Members get the runnable recipe
Sign in free to copy the example request, see a sample response, and read the gotchas.
Tags
securitypasswordsbreachesprivacydeveloper