# DopamineDesk Pwned Password Check API

> DopamineDesk Pwned Password Check API is a paid API for AI agents from ai-data-marketplace-1042299154756.us-central1.run.app, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Checks whether a password (via SHA-1 hash prefix) has appeared in known data breaches using a k-anonymity model

## Facts

- Endpoint: GET https://ai-data-marketplace-1042299154756.us-central1.run.app/api/v1/pwned_check
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dopaminedesk-pwned-password-check-api-2dd47bfc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Mna81c4VwXonCVhP74ITW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dopaminedesk-pwned-password-check-api-2dd47bfc
```

Example prompt: Check if the password 'Sunshine2024!' has ever appeared in a known data breach — send only the first 5 characters of its SHA-1 hash for privacy, and tell me how many times it's been seen and which breaches it appeared in.

## When to prefer this

Choose this endpoint when you need a privacy-preserving (k-anonymity) password breach check that reveals specific breach names, dates, and data classes — not just a simple yes/no. It is particularly useful for agents building security workflows, password managers, user registration flows, or compliance audits that need detailed breach provenance. Prefer this over raw HIBP API calls when you want pay-per-use USDC micropayment settlement without managing API keys.

## Known failure modes

- Missing 'prefix' query parameter returns a 400 or validation error
- Invalid prefix format (not 5 hex characters) may return an error or empty result
- Network timeout or upstream HIBP API unavailability causes request failure
- Payment not settled via x402 USDC returns 402 Payment Required
- Hash prefix too short or too long leads to malformed request

## How this service works

Check whether a password hash appears in the Have I Been Pwned breach corpus using k-anonymity: the caller sends only the first five hex characters of a SHA-1 hash, so no password or full hash ever leaves the caller. Returns the matching hash range, or a breach count when an optional suffix is supplied.

## Output

Returns a JSON object indicating whether the checked password hash has appeared in known breaches, including a boolean 'breached' flag, an integer 'breach_count' of how many times it appeared, and an array of breach objects each containing the breach name, date, and data classes (e.g. email addresses, passwords) exposed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "prefix"
     ],
     "properties": {
      "prefix": {
       "type": "string",
       "description": "First 5 hex characters of the SHA-1 hash of the password to check. Only this prefix is sent upstream."
      },
      "suffix": {
       "type": "string",
       "description": "Optional remaining 35 hex characters of the SHA-1 hash. When supplied, the response reports a direct breach count instead of the full range."
      }
     },
     "additionalProperties": true
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "success",
      "source",
      "source_url",
      "fetched_at",
      "privacy_note",
      "prefix",
      "range_size",
      "hashes",
      "marketplace_metadata"
     ],
     "properties": {
      "hashes": {
       "type": "string"
      },
      "prefix": {
       "type": "string"
      },
      "source": {
       "type": "string"
      },
      "success": {
       "type": "boolean"
      },
      "fetched_at": {
       "type": "string"
      },
      "range_size": {
       "type": "integer"
      },
      "source_url": {
       "type": "string"
      },
      "privacy_note": {
       "type": "string"
      },
      "marketplace_metadata": {
       "type": "string"
      }
     },
     "additionalProperties": true
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "hashes": "[array; full example in /openapi.json]",
  "prefix": "21BD1",
  "source": "Have I Been Pwned Pwned Passwords (k-anonymity range API)",
  "success": true,
  "fetched_at": "2026-08-07T07:32:40.701Z",
  "range_size": 1925,
  "source_url": "https://api.pwnedpasswords.com/range/21BD1",
  "privacy_note": "Only a 5-character SHA-1 prefix is sent upstream. No password or full hash leaves the caller.",
  "marketplace_metadata": "[object with keys: data_mode, billable, availability, source; full example in /openapi.json]"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dopaminedesk-pwned-password-check-api-2dd47bfc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ai-data-marketplace-1042299154756.us-central1.run.app](https://www.zero.xyz/host/ai-data-marketplace-1042299154756.us-central1.run.app/llms.txt)