Passwords API

Quickly and easily check if a given password is weak or known to be compromised

Check passwords to see if they are compromised

post

Allows you to check whether a given password is known to be compromised, without needing to pass the exact password hash in. Rather than passing exact hashes of the password to the API, it is only necessary to supply the first 10 hex characters of each hash. A list of candidate hashes will then be returned and can be compared locally with the exact hash to determine if there was a match. This is the recommended approach for new implementations using the Passwords API.

Authorizations

enzoic_auth

AuthorizationstringRequired

The Enzoic API uses a basic auth scheme where the username is your API key and the password is your API secret.
See https://docs.enzoic.com/enzoic-api-developer-documentation/using-the-enzoic-api#api-authentication for more details.

Body

application/json

partialSHA256stringRequired

The first 10 hex characters of the SHA-256 hash of the password to be checked. The password should be in UTF-8 encoding prior to hashing.

Example: 9f86d08188

Responses

200

One or more possible candidate matches were found. The response body contains the candidates. If any of the candidate hashes match the exact hash, this is a compromised password, i.e. a “hacked” password.

application/json

404

No candidate matches were found in the database of compromised passwords – indicates password is not known to be compromised.

post

/passwords

HTTPcURLJavaScriptPython

POST /v1/passwords HTTP/1.1
Host: api.enzoic.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 30

{
  "partialSHA256": "9f86d08188"
}

{
  "candidates": [
    {
      "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
      "revealedInExposure": true,
      "exposureCount": 10
    }
  ]
}