Password Breach Checker API

Network tool

POST https://api.findutils.com/api/tools/password-breach-checker/execute

Return whether a password appears in known data breaches and how many times, using the Have I Been Pwned k-anonymity range API. Send `password` and it travels to this API over TLS, is hashed here, and only the first 5 characters of its SHA-1 go on to HIBP; the request body is not logged. For end-to-end k-anonymity send `sha1_prefix` (the first 5 hex characters of the SHA-1 you computed) instead, and match your own suffix in the returned `range`.

Open the tool Try it

Request body

application/json

password

string optional

The password to check. Over this API it is sent to FindUtils over TLS, hashed server-side, and only the 5-character SHA-1 prefix goes to Have I Been Pwned; it is not logged or returned. Use sha1_prefix instead to keep the password on your side.
sha1_prefix

string optional

The first 5 hex characters of the SHA-1 hash you computed yourself. Returns every breached suffix in that range; find yours in `range` to finish the check without sending the password or its full hash.

Example arguments

Verified

{
  "password": "password"
}

curl -X POST https://api.findutils.com/api/tools/password-breach-checker/execute \
  -H "Content-Type: application/json" \
  -d '{
    "password": "password"
  }'

const response = await fetch('https://api.findutils.com/api/tools/password-breach-checker/execute', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"password":"password"}),
});
const data = await response.json();

import requests

response = requests.post(
    "https://api.findutils.com/api/tools/password-breach-checker/execute",
    json={"password":"password"},
)
data = response.json()

$ch = curl_init('https://api.findutils.com/api/tools/password-breach-checker/execute');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"password":"password"}',
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);

Also an MCP tool

Call password_breach_checker from Claude, Cursor or any MCP client. Same arguments, same output.

https://mcp.findutils.com

MCP reference

Rate limit: 60 a minute, per IP
Auth: None
REST id: password-breach-checker
MCP name: password_breach_checker
Category: Security
Machine-readable: openapi.json · markdown.md

This tool fetches a fixed, hard-coded public upstream, never a private host. Results depend on that upstream.

Request body

Example arguments

More Security tools

More to explore