SecurityProtection

Vault Monitoring

Alert password-manager users when stored credentials show up in newly leaked data.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

bank.com
shop.ioLeaked
mail.com

The problem

Password managers hold hundreds of credentials per user, and any of them can go from safe to breached overnight. Users expect their vault to tell them. That is part of what they are paying for.

With Encrata

Check vault entries against breach data without the passwords leaving the device: the vault hashes each entry with SHA-1 and sends only the hash. Encrata passes just the first 5 characters of that hash to the breach source (k-anonymity). Flag newly breached entries with a red badge and a one-tap path to rotate, and your vault delivers on its core promise.

How it works

1

Hash locally

Your client hashes the password with SHA-1 and sends the 40-character hash. The password itself never leaves the device.

2

We match anonymously

Encrata queries the breach corpus with only the first 5 characters of the hash (k-anonymity) and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Vault Monitoring runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://developer.encrata.com/api/lookup/email/password/breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "message": "This password has appeared in known breaches.",
  "credits": 1
}

Check without exposing

Hash each entry with SHA-1 on the client and send the 40-character hash, never the password. Encrata queries the breach source with only the first 5 characters of the hash (k-anonymity) and returns whether it was found and how often. Plaintext passwords never leave the machine, which is the property your marketing can and should state precisely. Re-screen on a schedule and badge newly breached entries.

The vault keeps its promise

A vault that flags 'this credential appeared in a breach, rotate it' delivers the promise users bought: not just storage, but stewardship. Prioritize the rotation prompts by the count field. A password seen fifty million times is a different emergency than one seen twice. Pair each flag with the site's change-password deep link so users reach the right page in one tap.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches, choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://developer.encrata.com/api/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'