EnterprisePrivileges

Admin Protection

Apply stricter password screening to administrator and other privileged accounts.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

member@corp.comStandard
admin@corp.comStrict screening

The problem

An admin account is worth a thousand user accounts to an attacker. Privileged users with breached passwords are your single largest preventable risk, and they're often exempted from the very controls they should exceed.

With Encrata

Enforce zero-tolerance screening on privileged accounts: any breach history at all rejects the password, checked at every change and on a re-screening schedule. Standard accounts get standard rules; the accounts that can drop your database get stricter ones.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Admin Protection runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Zero tolerance on privileged accounts

Enumerate privileged accounts from your IdP, admins, service owners, anyone with production access, and apply zero-tolerance screening: any breach history rejects the password, enforced at creation, change and on a re-screening schedule. Pair with mandatory MFA so the password is never the only lock on a privileged door.

Cheap insurance on big keys

Privileged credentials are the highest-value target in your estate, and their compromise is disproportionately catastrophic, one admin takeover outweighs hundreds of user-level incidents. Stricter screening on a few dozen accounts is cheap insurance, and 'privileged accounts have enhanced credential controls' is a sentence that appears verbatim in most compliance frameworks.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'