---
title: "Search password hashes by prefix"
method: GET
path: "/password-range"
tags: ["Password Range"]
---

# Search password hashes by prefix

`GET /password-range`

Search leaked password hashes (SHA-1) by prefix or full hash and get the distinct matches with their occurrence counts.

## Query parameters

- `prefix` string, required — SHA-1 prefix or full hash to search for.
- `limit` integer — Maximum number of matching hashes to return.
- `suffix_only` boolean — If true, return only hash suffixes (after the first 5 chars) instead of full hashes.

## Response `200`

Matching hashes returned successfully.

- PasswordRangeResponse
  - `prefix` string, required
  - `total` integer, required
  - `hashes` PasswordRangeItem[], required
    - `hash` string, required
    - `count` integer, required

## Other responses

- `400` — Prefix must be hexadecimal.
- `401` — Authentication required, or invalid/expired API key.
- `403` — Account pending email verification.
- `422` — Validation Error
- `429` — Rate limit exceeded. See Retry-After / X-RateLimit-* headers.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/82a99c608e1a/schema)