Skip to main content
POST
Check a password

How the password is protected

  1. Finowl hashes the password with SHA-1 in memory.
  2. Finowl intelligence searches by the first 5 characters of the hash only (k-anonymity), with padded responses so nothing can be inferred from their size.
  3. The exact match is found in memory and its count is returned to you.
The password is never logged, stored or included in the response. SHA-1 is used only for this range lookup, never for storing passwords.

Good to know

  • Send the exact password. Do not trim or lowercase it. Password1 and password1 are different passwords.
  • Check on submit, not on every keystroke. Each call uses a credit, and partial passwords are meaningless.
  • count measures popularity, not ownership. It tells you how widely a password has leaked, not which account or breach it came from.
  • Keep passwords out of your logs. Make sure your HTTP client and error tracker do not record the request body.

Guide: block breached passwords at sign up

A complete sign-up flow with sensible thresholds and a fail-open fallback.

Authorizations

Authorization
string
header
required

Your Finowl API key, for example finowl_3f9a.... Create keys in the dashboard under API Keys.

Body

application/json
password
string
required

The password to check, exactly as the user typed it. Whitespace and case are preserved.

Required string length: 1 - 4096
Example:

"P@ssw0rd"

Response

The check completed.

breached
boolean
required

true when the password appears at least once.

count
integer
required

How many times the password appears across known breaches.

Required range: x >= 0