Pwned Passwords API

Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 19 Aug 2026

What is the Pwned Passwords API?

The Pwned Passwords API lets you check whether a password has appeared in a known data breach without ever sending the password. It uses k-anonymity: you send only the first five characters of its SHA-1 hash, and it returns all matching suffixes.

This is the best-designed free security API in existence, and the design is the point. You never transmit the password, or even its full hash. You SHA-1 the password locally, send the first five hex characters, and receive back every hash suffix in that bucket along with how many times each appeared in a breach.

You then match the remainder of your hash locally. The server learns nothing about which password you were checking — it saw one of roughly a million buckets. This is exactly how NIST recommends screening passwords against known breaches, and it needs no API key at all.

Quick facts

Base URL: https://api.pwnedpasswords.com
Authentication: No API key required for the Pwned Passwords range endpoint. Other HIBP endpoints do require a paid key.
Rate limit: No rate limit on the range endpoint — it is designed to be called on every password set.
Pricing: Free, including commercial use.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Pwned Passwords API

Every request below was executed against the live API on 19 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Check a hash prefix range

GET https://api.pwnedpasswords.com/range/21BD1

curl

curl 'https://api.pwnedpasswords.com/range/21BD1'

JavaScript (fetch)

const res = await fetch("https://api.pwnedpasswords.com/range/21BD1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://api.pwnedpasswords.com/range/21BD1", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

0002EEFFB2CCA91812B5CC9956854E22BEB:4
000F6468C6E4D09C0C239A4C2769501B3DD:5959
00115AE168591C338025516216655E42A09:17
0018A45C4D1DEF81644B54AB7F969B88D65:9
0067AD792FB5BA36BECEF3506EE21E41DD9:59
009F8BAECE04D85D02A358D8BAF99819D2F:10
00BF5B8932DFD00FDB4A9529E7923068928:4
00CF63A94500831584A7BBAB1CCF86CBE17:70
00D4F6E8FA6EECAD2A3AA415EEC418D38EC:3
011053FD0102E94D6AE2F8B83D76FAF94F6:1
012

Parameters

Parameter	Type	Required	Description
`<prefix>`	path	Required	First 5 characters of the password's uppercase SHA-1 hash. `21BD1`
`Add-Padding`	header	Optional	Set to true to pad responses so their size leaks nothing. `true`

Response fields

(plain text)text: Line-separated `HASHSUFFIX:COUNT` pairs. Not JSON — parse by splitting on newlines and colons.
COUNTinteger: How many times that password appeared across known breaches. Higher means more dangerous.

What you can build with the Pwned Passwords API

Reject known-breached passwords at signup or password change
Audit existing password hashes against breach corpora
Meet NIST 800-63B guidance on screening compromised credentials
Teach k-anonymity as a practical privacy-preserving technique

Common errors and how to fix them

400

Prefix is not exactly 5 hexadecimal characters.

Fix: Uppercase the SHA-1 hash and take exactly the first 5 characters.

No match found in the response

The password does not appear in any known breach — this is the good case.

Fix: Absence from the list is not proof a password is strong; still enforce length and complexity rules.

Response is not JSON

It is plain text by design.

Fix: Split on newlines, then on ':' to get suffix and count.

Pwned Passwords API — frequently asked questions

Is it safe to send passwords to this API?

You never send the password or its full hash. You send only the first five characters of the SHA-1 hash and match the rest locally — the server cannot tell which password you checked. That is the k-anonymity model.

Does the Pwned Passwords API need an API key?

No. The range endpoint is completely free and unauthenticated, deliberately, so that everyone can screen passwords. Other Have I Been Pwned endpoints do require a paid key.

What does the count number mean?

How many times that password appeared across all known breaches. A count in the millions means it is one of the most commonly used passwords in existence and should always be rejected.

Should I block any password that appears at all?

Common practice is to reject anything appearing more than a handful of times. Blocking every single hit is defensible but will frustrate users with otherwise strong passphrases that leaked once.

Tools that pair with this API

Password Generator

Generate strong random passwords with cryptographically secure randomness. Choose length and character sets, see entropy strength, copy instantly.

SHA-256 Hash Generator

Generate SHA-256 hashes of text or files with the browser's Web Crypto API. 64-character hex digest, uppercase option, instant copy. Free and private.

MD5 Hash Generator

Generate MD5 hashes of text or files instantly in your browser. 32-character hex checksum with uppercase option and one-click copy. Free and private.

Alternatives to Pwned Passwords API

If Pwned Passwords does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
SSL Labs	Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.	No key	No	19 Aug 2026
Ransomware.live	Free Ransomware.live API with no key: recent ransomware victims claimed on leak sites, group profiles, negotiation data and infostealer context. Passive OSINT, no scanning.	No key	No	21 Aug 2026
Shodan InternetDB	Free Shodan InternetDB API with no key: open ports, hostnames, CVEs and technology tags for any IPv4 address. Fast, cached attack-surface data. Tested example included.	No key	Yes	21 Aug 2026

All Security & Auth APIs

Pwned Passwords is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 19 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.