Passwords API

Quickly and easily check if a given password is weak or known to be compromised

Check passwords to see if they are compromised

post

Allows you to check whether a given password is known to be compromised, without needing to pass the exact password hash in. Rather than passing exact hashes of the password to the API, it is only necessary to supply the first 10 hex characters of each hash. A list of candidate hashes will then be returned and can be compared locally with the exact hash to determine if there was a match. This is the recommended approach for new implementations using the Passwords API.

Authorizations

Body

partialSHA256stringRequired

The first 10 hex characters of the SHA-256 hash of the password to be checked. The password should be in UTF-8 encoding prior to hashing.

Example: 9f86d08188

Responses

200

One or more possible candidate matches were found. The response body contains the candidates. If any of the candidate hashes match the exact hash, this is a compromised password, i.e. a “hacked” password.

application/json

404

No candidate matches were found in the database of compromised passwords – indicates password is not known to be compromised.

post

HTTPcURLJavaScriptPython

POST /v1/passwords HTTP/1.1
Host: api.enzoic.com
Authorization: Bearer Base64(your_api_key:your_api_secret)
Content-Type: application/json
Accept: */*
Content-Length: 30

{
  "partialSHA256": "9f86d08188"
}

{
  "candidates": [
    {
      "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
      "revealedInExposure": true,
      "exposureCount": 10
    }
  ]
}