Does my password ever leave my device?

No. Your browser hashes the password with SHA-1 and sends only that hash to Encrata. From there we use k-anonymity: just the first 5 characters of the hash go to the breach source, so the check itself can't leak the secret.

Where does the breach data come from?

From large, well-known collections of leaked credentials aggregated from public data breaches. We match against hashed records, never plaintext passwords.

What does a positive result mean?

It means that exact password has appeared in at least one known breach. It does not mean your specific account was breached - but the password is unsafe to use and should be rotated.

Can I check emails for breaches too?

Yes. Email breach exposure is part of the Email lookup, which reports which known breaches an address appears in and what data was exposed.

Are GitHub leaks and exposed API keys available yet?

Yes, both are live. Scan a repository's code and full git history for hardcoded secrets, and sweep public code, gists and paste sites for exposed API keys scoped to assets you own, with the same credit system.

Is your password
already breached?

Privately check if a password has leaked in known breaches - via k-anonymity, so it never leaves your side.

Examplehttps://developer.encrata.com/api/lookup/email/password/breaches

1{
2  "check": "password",
3  "prefix": "5BAA6",
4  "found": true,
5  "count": 1203,
6  "message": "This password has appeared in known breaches - do not use it.",
7  "credits": 1
8}

Try one

Every breach lookup, explained

Find leaked secrets before someone else does.

••••••••Found · 1,203×

Methodk-anonymity

Sent upstream5 chars

Your password never leaves the browser.

Password breaches

Check whether a password has appeared in known data breaches, privately via k-anonymity - the password never leaves your side.

Repo scan3 secrets found

config/prod.env:12 · sk-…AB12

src/aws.ts:88 · AKIA…7Q

ScopeTree + history

Commita1b2c3d

GitHub leaks

Scan a repository's code and full git history for hardcoded secrets: API keys, tokens and private keys.

sk-…9f4cLive · exposed

ProviderOpenAI

SourcePublic gist

Matched to a domain you own.

Exposed API keys

Discover your organization's keys already leaking in public code, gists and paste sites - matched to assets you own.

Everything behind a breach check

One request tells you if a secret is compromised and how exposed it is.

Select a detail to explore the response

Example response

Exposure status

JSON

1{
2  "exposure_status": "found",
3  "times_seen": 128,
4  "prefix": "5BAA6",
5  "breach_sources": [
6    {
7      "name": "Example breach A"
8    },
9    {
10      "name": "Example breach B"
11    }
12  ],
13  "risk_grade": "high",
14  "remediation": {
15    "action": "rotate_secret",
16    "recommendation": "Reset this password on every account where it was reused."
17  }
18}

Illustrative schema and sample values

Simple, credit-based pricing

Password checks cost one credit per request. GitHub leaks and exposed API keys cost one credit per leak found. Cached repeat requests cost nothing.

Data field	Details	Credits	Rate limit
Password breach	Check if a password appears in breach corpora	1 credit	200/min
GitHub leaks	Scan the codebase and Git history for hardcoded secrets	1 credit per leak found	200/min
Exposed API keys	Find API keys exposed in public code and other sources	1 credit per leak found	200/min

Common questions

Should you have any questions, our team is at your service.

Built for
humans and AI

Start with 500 free credits

$curl https://developer.encrata.com/api/lookup/email/password/breaches -H "Authorization: Bearer YOUR_API_KEY" -H "Content-Type: application/json" -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'

Is your passwordalready breached?