Is your password
already breached?

Privately check if a password has leaked in known breaches - via k-anonymity, so it never leaves your side.

Examplehttps://developer.encrata.com/api/email/password/breaches
1{
2  "check": "password",
3  "prefix": "5BAA6",
4  "found": true,
5  "count": 1203,
6  "message": "This password has appeared in known breaches - do not use it.",
7  "credits": 1
8}
Try one

Every breach lookup, explained

Find leaked secrets before someone else does. Use them on their own or chain them in a workflow.

Repo scan3 secrets found

config/prod.env:12 · sk-…AB12

src/aws.ts:88 · AKIA…7Q

ScopeTree + history
Commita1b2c3d

GitHub leaks

Scan a repository's code and full git history for hardcoded secrets: API keys, tokens and private keys.

sk-…9f4cLive · exposed
ProviderOpenAI
SourcePublic gist

Matched to a domain you own.

Exposed API keys

Discover your organisation's keys already leaking in public code, gists and paste sites - matched to assets you own.

Everything behind a breach check

One request tells you if a secret is compromised and how exposed it is.

Select a detail to explore the response

Example response

Exposure status

JSON
1{
2  "exposure_status": "found",
3  "times_seen": 128,
4  "privacy": {
5    "method": "k-anonymity",
6    "hash_prefix_sent": "5 characters"
7  },
8  "breach_sources": [
9    {
10      "name": "Example breach A"
11    },
12    {
13      "name": "Example breach B"
14    }
15  ],
16  "risk_grade": "high",
17  "remediation": {
18    "action": "rotate_secret",
19    "recommendation": "Reset this password and any other accounts where it was reused."
20  }
21}
Illustrative schema and sample values

Ready-made breach workflows

Chain a breach check into the moments that matter - signup, login and rotation.

Signup screening

Stop compromised passwords from ever reaching your database.

  • User picks a password
  • Check breach exposure
  • Flag if leaked
  • Block or force a stronger one

Account-takeover watch

Catch reused, leaked passwords before attackers do.

  • Re-check credentials on a schedule
  • Look up breach exposure
  • Detect newly leaked secrets
  • Trigger a forced reset

Secret rotation

Find exposed secrets and rotate them fast.

  • Collect stored secrets
  • Check each for exposure
  • Prioritise the live ones
  • Rotate and confirm clean

Simple, credit-based pricing

Password checks cost one credit per request. GitHub leaks and exposed API keys cost one credit per leak found. Cached repeat requests cost nothing.

Data fieldDetailsCreditsRate limit
Password breachCheck if a password appears in breach corpora1 credit200/min
GitHub leaksFind exposed secrets in GitHub repositories and commit history1 credit per leak found200/min
Exposed API keysFind API keys exposed in public code and other sources1 credit per leak found200/min

Common questions

Should you have any questions, our team is at your service.

No. We use k-anonymity: only a short hash prefix of the password is sent to the API. The full password and its complete hash never leave your side, so the check itself can't leak the secret.

Built for humans and AI

Start with 500 free credits
$curl https://developer.encrata.com/api/email/password/breaches -H "Authorization: Bearer YOUR_API_KEY" -d '{"password": "hunter2"}'