# Password Breach Check

> Password Breach Check is a paid API for AI agents from skinwinking.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-31).

Checks whether a given password has appeared in known data breaches, returning breach status and exposure count

## Facts

- Endpoint: GET https://skinwinking.com/api/v1/util/password-breach?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/password-breach-check-8cc3a201
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Mt-D0aE-fW9zjQi9L7QA-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability password-breach-check-8cc3a201
```

Example prompt: Can you check if the password 'Summer2024!' has ever appeared in a known data breach and tell me how many times it's been seen?

## When to prefer this

Use this endpoint when you need a fast, pay-per-call password breach lookup without a monthly API subscription. Ideal for agents that perform occasional credential hygiene checks and want to pay only per query via USDC micropayment. Prefer this over direct HIBP API calls when already integrated into the x402 payment flow on Base, Polygon, or Solana.

## Known failure modes

- Missing both sha1 and password query parameters — returns 400 bad request
- Invalid SHA-1 hash format — may return error or unexpected result
- Breach database unavailable — may return 503 or timeout
- Payment not received via x402 — returns 402 Payment Required
- Rate limiting if too many calls in quick succession

## How this service works

50 pay-per-call tools for agents over x402 (USDC on Base, Polygon, Solana): crypto market data, token audits, indicators, swap routing, web extraction, DNS/WHOIS/email checks, FX, weather and AI text/image tools.

## Output

A JSON object with a boolean 'breached' field indicating whether the password appeared in known breach datasets, and a 'timesSeen' integer showing how many times it was found across breach records (e.g. {"breached": true, "timesSeen": 52256179}).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "sha1": {
       "type": "string",
       "description": "SHA-1 hash of the password (preferred)"
      },
      "password": {
       "type": "string",
       "description": "Plaintext password; hashed immediately, never stored"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "breached": true,
  "timesSeen": 52256179
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/password-breach-check-8cc3a201/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from skinwinking.com](https://www.zero.xyz/host/skinwinking.com/llms.txt)