# Password Breach Check (k-Anonymity via Have I Been Pwned)

> Password Breach Check (k-Anonymity via Have I Been Pwned) is a paid API for AI agents from 402.com.tr, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Checks whether a password has appeared in known data breaches using k-anonymity (only a 5-char SHA-1 prefix is sent), returning a GO/HOLD/STOP signal plus occurrence count.

## Facts

- Endpoint: GET https://402.com.tr/api/x402/breach-check
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/password-breach-check-k-anonymity-via-have-i-been-pwned-a051f053
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fYA3bBlGzVwhwF_67QuKT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability password-breach-check-k-anonymity-via-have-i-been-pwned-a051f053
```

Example prompt: Can you check if the password 'S3cur3P@ss2024!' has ever appeared in a known data breach — I want to know if it's safe to use or if it's already compromised?

## When to prefer this

Choose this endpoint when you need a privacy-preserving breach check that uses k-anonymity so the actual password is never sent over the wire, and you want a structured GO/HOLD/STOP signal rather than a raw API response. Prefer it over direct HIBP API calls when you need a pay-per-call model with no API key management, or when operating within an x402 payment-enabled agentic workflow. Not suitable for email breach lookups — use a dedicated email breach endpoint for that.

## Known failure modes

- Missing 'password' query parameter returns a 400 error
- Network or upstream HIBP API unavailability returns a 5xx error
- Empty or extremely short passwords may return unexpected results
- Non-string or malformed input rejected by schema validation
- Rate limiting or quota exhaustion on the upstream HIBP Pwned Passwords API

## How this service works

Have I Been Pwned Pwned Passwords via k-anonymity: only a 5-char SHA-1 prefix leaves the server. Returns pwned + occurrence count and a GO/HOLD/STOP. Password is not stored. Email breach lookup not offered.

## Output

Returns a structured response containing: a GO/HOLD/STOP risk signal indicating password safety, a boolean indicating whether the password was found in breach data (pwned), and an integer occurrence count showing how many times it has appeared across known breach datasets. The password itself is never transmitted — only the first 5 characters of its SHA-1 hash leave the client.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "password"
     ],
     "properties": {
      "password": {
       "type": "string",
       "description": "Password to check"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/password-breach-check-k-anonymity-via-have-i-been-pwned-a051f053/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 402.com.tr](https://www.zero.xyz/host/402.com.tr/llms.txt)