Have I Been Pwned API

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this — and be glad you cannot. Assembling a corpus of breached credentials means holding a large quantity of other people's stolen passwords, which is a liability rather than an asset.

**The password half is already free and needs no key.** The range API is the part worth understanding, because the design is the lesson:

You hash the password, send the **first five characters of the hash only**, and receive back every suffix in that bucket. You compare locally. The service never learns the password, never learns the full hash, and cannot tell which of the several hundred results you were asking about. That is k-anonymity, it costs nothing, and it means checking a password against the corpus is safe to do on every signup.

WHAT TO BUILD AROUND IT
- **Check every new and changed password against the range API.** One request, no key, and it does more for account security than any complexity rule ever written
- If the check fails or times out, allow the password rather than blocking. A verification service being down must never stop somebody signing in
- Cache the bucket briefly, since common passwords repeat
- Never log the password, the hash, or the prefix
- Say plainly in the interface why a password was rejected — 'this one has appeared in a breach' — because 'too weak' teaches nothing and is often wrong

AND THE MIRROR, IF YOU CANNOT CALL OUT
- The password hash set is published for download. Mirror it, index it, and run the same range lookup locally
- That is a large file and a table, it costs nothing to run, and it removes the external dependency entirely for an application that must not make outbound calls

WHAT NOT TO DO
- Do not collect breach dumps yourself. Holding them is a legal exposure, storing them safely is a real burden, and there is no version of this that ends well for a small company
- Do not check somebody's address against a breach list and tell them without a reason to. That is their news to receive from a service they chose

THE DOMAIN HALF
Monitoring whether addresses at your own domain appear in a new breach is a genuine service and it is what the subscription is for. There is no substitute, because there is no corpus.

THE ONE-LINE VERSION
The corpus is unbuildable and unwise to hold. Use the free range API on every password change — or mirror the hash set locally — and pay only if you need domain monitoring.