ISismalicious
check

k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus.

Changed on

Send the first 5 hex digits of a password's SHA-1 (or NTLM with mode=ntlm); match digits 6–17 of your hash against entries[].suffix yourself. Neither the password nor its full hash is sent. Answered from a local copy of the corpus refreshed monthly. Anonymous callers get 10 requests an hour per IP and, without the password checker's pt token, 50 a month per IP (a Free key gets 250); an API key pays one request of its monthly quota.

get/pwned-passwords/range/{prefix}

Request

  • Base URL
    https://api.ismalicious.com
  • Auth
    • none
    • or API key in header X-API-KEY
    • or HTTP bearer
    • or HTTP basic

Path parameters

prefixstring required

First 5 hex digits of the SHA-1 or NTLM hash

Query parameters

modestring

sha1 (default) or ntlm

ptstring

Browser proof-of-page token minted by the public password checker (/security/breaches). Only consulted for an anonymous caller: with a valid one the lookup is exempt from the anonymous monthly cap. API-key and session callers never need it.

Response

Every hash under the prefix

corpusUpdatedAtstring nullable
modestring required

sha1 | ntlm

prefixstring required
sourcestring required
suffixLengthinteger required

Hex digits per suffix: 12. Match digits 6–17 of your hash (68 bits in all, a false match on one query in about 10^11)

Example response

{
  "entries": [
    {
      "count": 10434004,
      "suffix": "1E4C9B93F3F0"
    }
  ],
  "mode": "sha1",
  "prefix": "5BAA6",
  "suffixLength": 12
}

Changes