ConsumerSecurity

Private Checks

Let consumers check password exposure privately using k-anonymity. Only a SHA-1 hash leaves their device.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

••••••••
only SHA-1 hash sent: a94f2…
k-anonymity: password stays on device

The problem

Consumers want to know if their password leaked, but typing your password into a website to check if it's compromised is exactly what security training tells people never to do. Trust is the whole product.

With Encrata

The k-anonymity flow makes the check verifiably private: the password is hashed on the device and only the hash is sent, of which Encrata passes just the first 5 characters to the breach source. You can document, and users can verify, that the password never leaves their machine.

How it works

1

Hash locally

Your client hashes the password with SHA-1 and sends the 40-character hash. The password itself never leaves the device.

2

We match anonymously

Encrata queries the breach corpus with only the first 5 characters of the hash (k-anonymity) and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Private Checks runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://developer.encrata.com/api/lookup/email/password/breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "message": "This password has appeared in known breaches.",
  "credits": 1
}

Privacy by architecture

The privacy claim is architectural, so implement it visibly: hash in client-side code users can inspect, send only the SHA-1 hash (Encrata passes just its first 5 characters to the breach source), and document the flow in plain language. 'Your password never leaves your device, verifiably' is the differentiator in a category where trust is the entire purchase decision.

Trust users can verify

K-anonymity's elegance is that privacy and function don't trade off: the check is exactly as accurate as a plaintext lookup while keeping the full password on the device. That property also simplifies your own compliance story: a service that never receives passwords has categorically less to protect, breach-notify about, or explain.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches, choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://developer.encrata.com/api/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'