Does my password ever leave my device?

No. We use k-anonymity: only a short hash prefix of the password is sent to the API. The full password and its complete hash never leave your side, so the check itself can't leak the secret.

Where does the breach data come from?

From large, well-known collections of leaked credentials aggregated from public data breaches. We match against hashed records, never plaintext passwords.

What does a positive result mean?

It means that exact password has appeared in at least one known breach. It does not mean your specific account was breached - but the password is unsafe to use and should be rotated.

Can I check emails for breaches too?

Yes. Email breach exposure is part of the Email lookup, which reports which known breaches an address appears in and what data was exposed.

Are GitHub leaks and exposed API keys available yet?

They're on the way. Both will let you find leaked secrets in your own code and across public sources, scoped to assets you own, with the same credit system.

Is your password
already breached?

Privately check if a password has leaked in known breaches - via k-anonymity, so it never leaves your side.

Examplehttps://developer.encrata.com/api/email/password/breaches

1{
2  "prefix": "5BAA6",
3  "found": true,
4  "count": 1203,
5  "message": "This password has appeared in known breaches - do not use it.",
6  "credits": 1
7}

Try one:

Every breach lookup, explained

Find leaked secrets before someone else does. Use them on their own or chain them in a workflow.

••••••••Found · 1,203×

Methodk-anonymity

Prefix sent5 chars

Your password never leaves the browser in full.

Password breaches

Check whether a password has appeared in known data breaches, privately via k-anonymity - the password never leaves your side.

Repo scan3 secrets found

config/prod.env:12 · sk-…AB12

src/aws.ts:88 · AKIA…7Q

ScopeTree + history

Commita1b2c3d

GitHub leaks

Coming soon

Scan a repository's code and full git history for hardcoded secrets: API keys, tokens and private keys.

sk-…9f4cLive · exposed

ProviderOpenAI

SourcePublic gist

Matched to a domain you own.

Exposed API keys

Coming soon

Discover your organisation's keys already leaking in public code, gists and paste sites - matched to assets you own.

Everything behind a breach check

One request tells you if a secret is compromised and how exposed it is.

Exposure status

A clear found / not-found verdict on whether the secret has leaked.

Times seen

How many times the password has appeared across known breach corpora.

k-anonymity

Only a short hash prefix is sent - the plaintext secret never leaves the browser.

Breach sources

Which known breaches and leaks the secret has been associated with.

Risk grade

A severity read on how dangerous the exposure is, so you can prioritise.

Remediation

A clear recommendation to rotate or stop using the compromised secret.

Ready-made breach workflows

Chain a breach check into the moments that matter - signup, login and rotation.

Signup screening

Stop compromised passwords from ever reaching your database.

User picks a password
Check breach exposure
Flag if leaked
Block or force a stronger one

Account-takeover watch

Catch reused, leaked passwords before attackers do.

Re-check credentials on a schedule
Look up breach exposure
Detect newly leaked secrets
Trigger a forced reset

Secret rotation

Find exposed secrets and rotate them fast.

Collect stored secrets
Check each for exposure
Prioritise the live ones
Rotate and confirm clean

Simple, credit-based pricing

Pay the credit cost on a fresh request, or get it free when Encrata serves a cached result.

Data field	Details	Without cache	With cache
Password breach	Check if a password appears in breach corpora	1 credit	Free

Common questions

Built for
humans and AI

Start with 500 free credits

$curl https://developer.encrata.com/api/email/password/breaches -H "Authorization: Bearer YOUR_API_KEY" -d '{"password": "hunter2"}'

Is your passwordalready breached?