Have I Been Pwned: Pwned Passwords API

Have I Been Pwned: Pwned Passwords API

Have I Been Pwned's Pwned Passwords range API checks whether a password hash appears in known breach corpora using k-anonymity: send the first 5 characters of a SHA-1 (or NTLM) hash and get back matching hash suffixes with counts. The full hash sets can be downloaded with an open-source downloader. No email addresses or plaintext passwords are returned.

Coverage

Password hashes seen in data breaches. The Passwords page says "Pwned Passwords is free and open source for everyone to use." The paid HIBP subscriptions cover email and domain breach search, which this entry does not link.

Verdict

Freemium: Pwned Passwords is free, while email and domain breach search needs a paid subscription key. Licence: Custom: the API docs say "there is no licencing or attribution requirements on the Pwned Passwords API" and the terms of use say "Pwned Passwords (including the range API and downloadable hash sets) and the unauthenticated breach catalogue endpoints (including /breaches, /breach/{name}, /latestbreach and /dataclasses) may be used for any lawful purpose, including within commercial products and for the benefit of third parties." Signal Lab links only.