CybersecurityNotification

User Alerts

Warn users still relying on passwords that have already appeared in known breaches.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

Password compromised

Seen in a public breach dump

Change password

The problem

A password that was safe when chosen doesn't stay safe, new dumps land constantly. Users have no way of knowing their three-year-old password is now in every cracking wordlist on the internet.

With Encrata

Re-screen stored password hashes against new breach data on a schedule and notify affected users. The k-anonymity model means you check without exposing anything, and the alert, 'your password has appeared in a breach, please change it', arrives before the stuffing attack does.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

User Alerts runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Re-screen on a schedule

Store password hashes at creation (you already do), then re-screen them against breach data on a rolling schedule. New hits queue an alert, in-app first, email second, with a one-tap path to the change-password flow. The k-anonymity model means the re-screening loop never handles or transmits anything reversible.

Goodwill from a security feature

This catches the failure mode screening alone misses: the password that was clean at signup and leaked two years later. Users experience it as the product watching out for them, which is rare goodwill for a security feature, and the accounts that act on the alert stop appearing in your account-takeover statistics.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password policy

12+ characters
Not in breach data
Rotated ≤ 90 days

Policy Enforcement

Screen employee passwords against breach databases to enforce your security policy

EnterpriseIdentity
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'