ConsultingAudit

Security Audits

Measure how many employees are using exposed passwords across the whole organization.

Start with 500 free creditsDocumentation

Password breaches · 1 credit per lookup · no monthly fee

Org audit

12%

38 of 312 employees use exposed passwords

The problem

'What fraction of our workforce uses breached passwords?' is a question every CISO should be able to answer and almost none can. Without measurement, password policy is faith-based security.

With Encrata

Audit the whole organization with bulk checks, hash every password server-side, submit the hashes, and get an exposure rate. '38 of 312 employees use breached passwords' is a finding that gets budget approved; run it quarterly and you get a trend line too.

How it works

1

Hash locally

Your client hashes the password and sends only the first characters of the hash, the password itself never leaves the device.

2

We match anonymously

Encrata checks the prefix against the breach corpus via k-anonymity and returns whether the password was found and how many times.

3

Reject or accept

Block passwords that appear in breach dumps at registration, reset or login. One credit per check.

One call, structured answer

Security Audits runs on the password breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • k-anonymity: the password never leaves the user's device
  • Blocks the exact credentials attackers use in stuffing lists
  • 1 credit per check, screen every registration and reset
  • A single API call satisfies auditors asking for compromised-password controls
Terminal
curl -X POST "https://encrata.com/api/agent/password-breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha1": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8"}'
response.json
{
  "prefix": "5BAA6",
  "found": true,
  "count": 52372427,
  "credits": 1
}

Audit with bulk checks

Run the audit with the bulk endpoint: hash the workforce's passwords via your IdP or directory export, submit the hashes, and compute the exposure rate. De-duplication is built in, so shared passwords surface as an additional finding. Keep the raw results access-controlled, the aggregate is for the report, the individual hits are for remediation.

A number that moves budgets

The number transforms the conversation: 'twelve percent of staff use breached passwords' is a budget line, a training mandate and a policy change rolled into one finding. Re-run quarterly and the trend becomes the KPI, a falling exposure rate is one of the few security metrics that's simultaneously honest, measurable and board-legible.

More password breaches use cases

View all

Choose password

••••••••••
Found in 3 breaches — choose another

Password Screening

Reject passwords already circulating in breach dumps at the moment of registration

SaaSAuthentication

Reset password

••••••••
••••••••••••

Reset Screening

Stop users from choosing a compromised password when they reset the old one

BankingSecurity

Password compromised

Seen in a public breach dump

Change password

User Alerts

Warn users still relying on passwords that have already appeared in known breaches

CybersecurityNotification
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'