Password Breach Checker API

POST

Check whether a password has leaked in a known data breach.

Password Breach Checker tells you whether a password appears in the Pwned Passwords corpus of passwords exposed in data breaches. Send the password or its SHA-1 hash and get a breached flag. Paid plans add how many times it was seen and a risk level.

Try it — live request, no key required

Request

POSTapi.apiverve.com/v1/passwordbreach

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "breached": true,
    "breachCount": 2266543,
    "riskLevel": "critical",
    "inputType": "password",
    "hashPrefix": "CBFDA"
  }
}

About the Password Breach Checker API

The password is hashed with SHA-1 on our side and only the first 5 characters of the hash are sent to the Pwned Passwords range API, with response padding on, so the password itself never leaves the request. It is not logged, stored or returned. You can also send the SHA-1 yourself so the plain password never reaches us.

What people use it for

Sign-Up and Password Change: Reject or warn on passwords that have appeared in breaches when a user creates an account or changes their password, as NIST SP 800-63B recommends.
Login Risk Scoring: Flag accounts whose current password is known to be breached and prompt a reset before credential stuffing finds them.
Password Audits: Check stored SHA-1 hashes from a legacy system against the breach corpus without handling plain passwords.
Password Managers: Mark saved passwords that have leaked so users know which ones to change first.

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

Other ways to use Password Breach Checker

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.on VerveContext

Questions.

Common questions about the Password Breach Checker API.

Read the docs →

How many password checks does the Starter plan cover?

Starter covers 40,000 password checks each month. At 5 credits per request, that works out to $0.75 per 1,000 checks, or about $0.00075 per check. The Free plan includes 40 checks per month for testing.

What does the Free plan return?

The Free plan returns whether the password has been breached, the input type and the 5-character hash prefix that was looked up. Paid plans add breachCount, the number of times the password appears in the corpus, and a riskLevel bracket.

Is my password sent to a third party?

No. The password is hashed with SHA-1 and only the first 5 characters of that hash are sent to the Pwned Passwords range API, which returns every hash that shares the prefix. The match is made on our side, and the password is never logged, stored or returned.

Can I check a hash instead of the plain password?

Yes. Send hash with the 40-character hex SHA-1 of the password instead of password, and the plain text never reaches us. Hashes are not case sensitive.

How are the risk levels defined?

riskLevel is none when the password was not found, low for 1 to 9 sightings, medium for 10 to 999, high for 1,000 to 99,999 and critical for 100,000 or more.

Request parameters — POST /v1/passwordbreach

Sent as JSON in the request body. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Optional

Parameter	Type	Example	Description
`password`Optional	string	`password123`	The password to check. Hashed on receipt and never stored. Send this or hash length 0-1024
`hash`Optional	string	`5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8`	The 40-character hex SHA-1 of the password, instead of the password itself

Example request

curl -X POST "https://api.apiverve.com/v1/passwordbreach" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password":"password123","hash":"value"}'

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.
`content-type`Required	POST body	`application/json`

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — POST /v1/passwordbreach

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "breached": true,
    "breachCount": 2266543,
    "riskLevel": "critical",
    "inputType": "password",
    "hashPrefix": "CBFDA"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`breached`	boolean	`true`	True when the password appears in the breach corpus
`breachCount`Premium	number	`2266543`	Number of times the password appears in the breach corpus
`riskLevel`Premium	string	`"critical"`	Exposure bracket: none, low (1-9), medium (10-999), high (1,000-99,999) or critical (100,000+)
`inputType`	string	`"password"`	Whether a password or a hash was checked
`hashPrefix`	string	`"CBFDA"`	The 5-character SHA-1 prefix that was sent to the range API

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 5 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	Password Breach Checker calls	Per 1,000 calls
Free	Free	200	40	Free
Starter	$29.99	200,000	40,000	$0.75
Pro	$99.99	1,000,000	200,000	$0.50
Mega	$299.99	4,000,000	800,000	$0.37

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/passwordbreach" \
  -H "x-api-key: YOUR_API_KEY"

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Call it from Node.js — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

Node.js

const res = await fetch("https://api.apiverve.com/v1/passwordbreach", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Call it from Python — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/passwordbreach",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Call it from C# / .NET — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/passwordbreach");
Console.WriteLine(json);

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Call it from Go — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/passwordbreach", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Call it from PHP — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/passwordbreach");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Call it from Ruby — POST /v1/passwordbreach

No SDK to install — this is a plain HTTPS call to /v1/passwordbreach with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/passwordbreach")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

ReferencePassword Breach Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Password Breach Checker API

Try it — live request, no key required

About the Password Breach Checker API

What people use it for

Ways to call it

Other ways to use Password Breach Checker

Questions.

Request parameters — POST /v1/passwordbreach

Optional

Authentication

Response — POST /v1/passwordbreach

Response fields

Response headers

Errors

What a call costs — 5 credits per call

Call it from cURL — POST /v1/passwordbreach

Resources

Call it from Node.js — POST /v1/passwordbreach

Resources

Call it from Python — POST /v1/passwordbreach

Resources

Call it from C# / .NET — POST /v1/passwordbreach

Resources

Call it from Go — POST /v1/passwordbreach

Resources

Call it from PHP — POST /v1/passwordbreach

Resources

Call it from Ruby — POST /v1/passwordbreach

Resources

Zero-code embed — one snippet, no backend

Changelog — Password Breach Checker API

Security

Ready to build with Password Breach Checker? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog