Passwords API

Quickly and easily check if a given password is weak or known to be compromised

Check passwords to see if they are compromised

Allows you to check whether a given password is known to be compromised, without needing to pass the exact password hash in. Rather than passing exact hashes of the password to the API, it is only necessary to supply the first 10 hex characters of each hash. A list of candidate hashes will then be returned and can be compared locally with the exact hash to determine if there was a match. This is the recommended approach for new implementations using the Passwords API.

post

/passwords

Authorizations

Body

partialSHA256stringrequired

The first 10 hex characters of the SHA-256 hash of the password to be checked. The password should be in UTF-8 encoding prior to hashing.

Example: 9f86d08188

Responses

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://api.enzoic.com/v1/passwords' \
  --header 'Authorization: Basic username:password' \
  --header 'Content-Type: application/json' \
  --data '{"partialSHA256":"9f86d08188"}'

200

404

200

{
  "candidates": [
    {
      "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
      "revealedInExposure": true,
      "exposureCount": 10
    }
  ]
}

One or more possible candidate matches were found. The response body contains the candidates. If any of the candidate hashes match the exact hash, this is a compromised password, i.e. a “hacked” password.