DeveloperInfrastructure

API Security

Add compromised-password detection to your authentication flow with a single API call.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

POST /v1/password/breaches

{

"breached": true,

"count": 2

}

The problem

You're building auth and know you should check passwords against breach data, but standing up your own copy of a breach corpus means gigabytes of data, update pipelines, and infrastructure that isn't your product.

With Encrata

One endpoint replaces the whole pipeline: POST a SHA-1 hash, get back found and count. The k-anonymity model means plaintext never leaves your client, there's no corpus to host or update, and compromised-password detection ships in your next release.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

API Security runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Three lines in your auth flow

Integration is deliberately minimal: SHA-1 the candidate password, POST the hash, branch on found. No corpus to download, no update pipeline, no infrastructure, the check lives as three lines in your auth service. The bulk endpoint covers migration scenarios where you need to screen an existing user base's hashes in one pass.

Zero infrastructure to carry

Building this yourself means hosting a multi-gigabyte corpus that updates continuously and answering for its freshness in security reviews; the endpoint outsources exactly that undifferentiated weight. Your auth flow gets the control that frameworks now expect, and your infrastructure diagram doesn't grow a new box.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'