Check whether a password has appeared in known data...
Check whether a password has appeared in known data breaches, using Have I Been Pwned's Pwned Passwords k-anonymity model — only the first 5 characters of the password's SHA-1 hash are ever sent upstream, so the service never sees the password or the full hash. POST { password } (hashed server-side) OR { sha1 } (the 40-hex SHA-1, for true zero-knowledge — hash it client-side and send only that). Returns breached (boolean), count (how many times it appears in breach corpora), and the sha1Prefix used. Backed by a 900M+ breached-credential corpus an LLM cannot know. For signup/password-policy enforcement and credential-hygiene checks. Absence is not a guarantee of strength.
Request
- Base URL: https://2s.io
- URL: https://2s.io/api/security/password-exposure
- Auth: API key in header PAYMENT-SIGNATURE
Query parameters
Try before you buy. Set to 1 for one free real call per endpoint per hour — no wallet or payment needed — to verify the endpoint before paying. Equivalent to sending the "X-2s-Trial: 1" request header. Listed only on operations that offer a trial; the others always answer 402.
Request body
Response
Changes
No recorded changes to this operation across all 1 revision of this API.