# Pwned Passwords API

**Canonical:** https://apis.io/apis/have-i-been-pwned/pwned-passwords/  
**Provider:** Have I Been Pwned — https://apis.io/providers/have-i-been-pwned/  
**Base URL:** https://api.pwnedpasswords.com  
**Documentation:** https://haveibeenpwned.com/API/v3#PwnedPasswords

Pwned Passwords API is one of 16 APIs that [Have I Been Pwned](https://apis.io/providers/have-i-been-pwned/) publishes on the [APIs.io](https://apis.io/) network. Tagged areas include Passwords, K-Anonymity, SHA-1, and Credential Stuffing. The published artifact set on APIs.io includes API documentation.

Free, unauthenticated, k-anonymity-based API to check whether a password hash appears in the 800+ million record Pwned Passwords dataset. Clients submit the first five characters of a SHA-1 hash and receive a list of matching suffixes with counts. No rate limit and no attribution required.

## Machine-readable artifacts (2)

- **Documentation** — https://haveibeenpwned.com/API/v3#PwnedPasswords
- **Project** — https://haveibeenpwned.com/Passwords

## Other Have I Been Pwned APIs (12)

- [Have I Been Pwned API v3](https://apis.io/apis/have-i-been-pwned/api-v3/)
- [Have I Been Pwned Breach API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-breach-api/)
- [Have I Been Pwned Breachedaccount API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-breachedaccount-api/)
- [Have I Been Pwned Breacheddomain API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-breacheddomain-api/)
- [Have I Been Pwned Breaches API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-breaches-api/)
- [Have I Been Pwned Dataclasses API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-dataclasses-api/)
- [Have I Been Pwned Domainverification API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-domainverification-api/)
- [Have I Been Pwned Latestbreach API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-latestbreach-api/)
- [Have I Been Pwned Pasteaccount API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-pasteaccount-api/)
- [Have I Been Pwned Range API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-range-api/)
- [Have I Been Pwned Stealerlogsbyemail API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-stealerlogsbyemail-api/)
- [Have I Been Pwned Stealerlogsbyemaildomain API](https://apis.io/apis/have-i-been-pwned/have-i-been-pwned-stealerlogsbyemaildomain-api/)

## Tags

Passwords, K-Anonymity, SHA-1, Credential Stuffing

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/have-i-been-pwned/pwned-passwords/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/have-i-been-pwned/.