---
title: "k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus."
method: GET
path: "/pwned-passwords/range/{prefix}"
tags: ["check"]
---

# k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus.

`GET /pwned-passwords/range/{prefix}`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/pwned-passwords/range/{prefix}`
- Auth: one of:
  - none
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

Send the first 5 hex digits of a password's SHA-1 (or NTLM with
`mode=ntlm`); match digits 6–17 of your hash against `entries[].suffix`
yourself. Neither the password nor its full hash is sent. Answered from a
local copy of the corpus refreshed monthly. Anonymous callers get 10
requests an hour per IP and, without the password checker's `pt` token,
50 a month per IP (a Free key gets 250); an API key pays one request of
its monthly quota.

## Path parameters

- `prefix` string, required

## Query parameters

- `mode` string
- `pt` string

## Response `200`

Every hash under the prefix

- PwnedPasswordRange: Every hash under a 5-hex prefix of the Pwned Passwords corpus
  - `corpusUpdatedAt` string, nullable
  - `entries` PwnedPasswordRangeEntry[], required
    - `count` integer, required
    - `suffix` string, required: The 12 hex digits that follow the prefix
  - `mode` string, required: `sha1` | `ntlm`
  - `prefix` string, required
  - `source` string, required
  - `suffixLength` integer, required: Hex digits per suffix: 12. Match digits 6–17 of your hash (68 bits in all, a false match on one query in about 10^11)

## Other responses

- `400`: Prefix not 5 hex digits, or mode not sha1/ntlm
- `429`: Anonymous limit (10/hour per IP, and 50/month per IP without a `pt` token; `X-RateLimit-Reason` says which) or the plan's quota
- `503`: The corpus is not loaded on this server yet

## Changes

- **2026-10-05** `9dfa82b5838d`: 1 info
  - added the new optional `query` request parameter `pt`
- **2026-10-01** `a4984fbff2c5`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/pwned-passwords/range/:prefix/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)