# Password Breach Check (k-Anonymity)

> Password Breach Check (k-Anonymity) is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Checks whether a password, SHA-1 hash, or NTLM hash has appeared in known data breaches using k-anonymity, returning a compromised flag and breach count without ever transmitting the plaintext.

## Facts

- Endpoint: POST https://api.agentstools.dev/breach/password
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/password-breach-check-k-anonymity-166211d7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_y2JmDkMbzuXCLmvO4ocsl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability password-breach-check-k-anonymity-166211d7 -d '<json body>'
```

Example prompt: Check if the password 'Hunter2!' has appeared in any known data breaches — use the k-anonymity method so the plaintext is never transmitted, and tell me if it's compromised and how many times it's shown up.

## When to prefer this

Choose this endpoint when you need a privacy-preserving credential breach check that uses k-anonymity so the plaintext password is never transmitted. It is ideal for agents enforcing password policies at sign-up, auditing credentials, or integrating breach-check into security workflows without the risk of exposing sensitive credentials to a third-party server. Prefer it over raw HIBP API calls when you want a simple, pre-packaged, agent-friendly interface with structured output including compromised status and breach count.

## Known failure modes

- Invalid or malformed hash format (not 40-hex for SHA-1 or 32-hex for NTLM) may return a validation error
- Missing required 'input' body fields returns a 400 bad request
- Network or upstream breach database unavailability may cause timeouts or 503 errors
- NTLM hash corpus is separate and may have different coverage than SHA-1 corpus
- A result of compromised=false does not guarantee the password is safe, only that it wasn't found in the indexed breaches

## How this service works

Check whether a password has appeared in known data breaches, using k-anonymity: the password is hashed locally and only a 5-character hash prefix is sent upstream, so the plaintext is never transmitted, logged or stored. Accepts a password, a SHA-1 hash or an NTLM hash. Returns compromised, breach_count and the hash prefix. Credential-exposure indicators, not a guarantee.

## Output

Returns a JSON object with a 'compromised' boolean indicating whether the input appeared in known breach data, a 'breach_count' integer showing how many times it was found, and the 'hash_prefix' (first 5 characters of the SHA-1 hash) used for the k-anonymity lookup. These are credential-exposure indicators, not a definitive security guarantee.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ntlm": {
   "type": "string",
   "description": "Alternative input: a full 32-hex NTLM hash (MD4 cannot be computed here, so send the hash for the NTLM corpus)"
  },
  "sha1": {
   "type": "string",
   "description": "Alternative input: a full 40-hex SHA-1 hash of the password (so the plaintext never leaves your side)"
  },
  "password": {
   "type": "string",
   "description": "Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/password-breach-check-k-anonymity-166211d7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)