# 2s Password Exposure Check (Have I Been Pwned via k-anonymity)

> 2s Password Exposure Check (Have I Been Pwned via k-anonymity) is a paid API for AI agents from 2s.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-12).

Checks whether a given password appears in known breach datasets using k-anonymous SHA-1 prefix lookup, returning breach count and status.

## Facts

- Endpoint: POST https://2s.io/api/security/password-exposure?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-password-exposure-check-have-i-been-pwned-via-k-anonymity-68dcba5f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-8vmEUcTfUifpnJHSXQeV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-password-exposure-check-have-i-been-pwned-via-k-anonymity-68dcba5f -d '<json body>'
```

Example prompt: Can you check whether the password 'Sunshine2020!' has ever shown up in a data breach, and tell me how many times it's been seen in leaked databases?

## When to prefer this

Use this endpoint when you need to check a specific password or its SHA-1 hash against known breach datasets with k-anonymity (only a 5-char prefix is transmitted, preserving privacy). Prefer the sha1 input mode for zero-knowledge checks where the plaintext should never leave the client. Ideal for security audits, user onboarding validation, or credential hygiene checks.

## Known failure modes

- Missing both password and sha1 fields — returns validation error
- Invalid SHA-1 hash format (not 40 hex chars) — returns error
- Network/upstream HIBP API unavailable — may return error or timeout
- Payment failure via x402 — request not processed

## How this service works

The (most) everything API: 575+ pay-per-call endpoints for AI agents — ground-truth data, a full AI gateway, and agent infrastructure (storage, queues, watchers). USDC via x402, no signup, no API keys, and upto billing: pay actual usage, not the quote.

## Output

Returns a JSON object with an ok flag, an items array (each with breached boolean, breach count, the SHA-1 prefix used, input mode, and a descriptive note), total count of results, and source metadata including the provider (Have I Been Pwned), license, and API URL.

## Example request

```json
{
 "password": "TestPassword123!"
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "sha1": {
   "type": "string",
   "description": "Alternatively, the 40-hex SHA-1 of the password (client-side hashing = zero-knowledge)."
  },
  "password": {
   "type": "string",
   "description": "Password to check (hashed server-side; only a 5-char SHA-1 prefix leaves)."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-password-exposure-check-have-i-been-pwned-via-k-anonymity-68dcba5f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)