---
title: "Lookup passwords for exposure"
method: POST
path: "/identity/password/lookup"
tags: ["Credentials"]
---

# Lookup passwords for exposure

`POST /identity/password/lookup`

## Request

- Base URL: `https://api.recordedfuture.com`
- URL: `https://api.recordedfuture.com/identity/password/lookup`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Checks if specified passwords were exposed.

## Request body

- PasswordLookupRequest
  - `passwords` PasswordHash[], required
    - union
      - FullPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash` string, required
      - PrefixPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash_prefix` string, required

## Response `200`

Success

- PasswordLookupResponse
  - `results` SinglePasswordLookupResult[], required
    - `password` union, required
      - FullPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash` string, required
      - PrefixPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash_prefix` string, required
    - `exposure_status` 'NeverExposed' | 'Uncommon' | 'Common', required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `500`: Internal Server Error
- `default`: Error

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api/revisions/95e20835fe80?raw)