---
title: "Breach exposure of a password, checked as an indicator."
method: POST
path: "/check/password"
tags: ["check"]
---

# Breach exposure of a password, checked as an indicator.

`POST /check/password`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/check/password`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

Send the SHA-1 or NTLM of the password — never the password itself, which
is refused with a 400. The answer comes from the local copy of Have I Been
Pwned's Pwned Passwords corpus (~2 billion hashes per mode, refreshed
monthly); nothing is cached, stored or saved as a report. For k-anonymity,
where only 5 hex digits leave your side, use
`GET /pwned-passwords/range/{prefix}` instead. One request of the monthly
quota.

## Request body

- PasswordCheckRequest: Body of `POST /check/password`: exactly one digest, never the password
  - `hash` string, nullable: Either digest; 40 hex reads as SHA-1, 32 as NTLM
  - `ntlm` string, nullable: NTLM hash of the password (MD4 of its UTF-16LE form), 32 hex characters
  - `sha1` string, nullable: SHA-1 of the password, 40 hex characters

## Response `200`

Verdict for the password behind the digest

- PasswordCheckResponse: Breach exposure of one password, from its SHA-1 or NTLM hash
  - `apiVersion` string, required
  - `corpusUpdatedAt` string, nullable: When the local copy of the corpus was downloaded
  - `count` integer, required: Times the password appears in the breach corpus
  - `exposed` boolean, required: Seen at least once in a breach
  - `hashType` string, required: `sha1` | `ntlm`
  - `indicatorType` string, required: Always `password`
  - `prevalence` string, required: `none` | `rare` (1–9) | `common` (10–999) | `very_common` (1 000+)
  - `recommendation` string, required: One sentence to relay to the user
  - `source` string, required
  - `sourceUrl` string, required
  - `verdict` string, required: `compromised` | `not_found`. Not found says nothing about strength

## Other responses

- `400`: Not exactly one digest, a malformed digest, or a plaintext `password` field
- `401`: Missing or invalid credentials
- `429`: Burst limit or monthly quota reached
- `503`: The corpus is not loaded on this server yet

## Changes

- **2026-10-01** `a4984fbff2c5`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/check/password/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)