EnterpriseIdentity

Policy Enforcement

Screen employee passwords against breach databases to enforce your security policy.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

Password policy

12+ characters
Not in breach data
Rotated ≤ 90 days

The problem

Your password policy says 'no compromised passwords' because the auditor's checklist does. Enforcing it with complexity rules alone is theater, 'P@ssw0rd!' passes every complexity check and appears in every breach dump.

With Encrata

Make the policy real: screen every password against breach data at creation and change. The check is one API call in your auth flow, and 'we verify against known breach corpora on every password event' is a sentence your auditor accepts without follow-up questions.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Policy Enforcement runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Policy as code, logged

Encode the policy as code at every password event: length and uniqueness rules from your existing validator, breach screening from the API, both enforced at creation, change and reset. Log each check's verdict and timestamp, the log stream is the enforcement evidence, and it accumulates without anyone maintaining a spreadsheet.

Paper and practice finally match

The gap between written policy and enforced policy is where audits find findings: 'no compromised passwords' on paper with only complexity rules in code is exactly the discrepancy assessors look for. With screening wired in, the policy document and the system behavior finally match, and the breach-count data tells you the policy is doing real work.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'