# PayAI Password Breach Checker

> PayAI Password Breach Checker is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Checks whether a password has appeared in known data breaches using k-anonymity, returning a compromised flag and breach count without ever transmitting the plaintext.

## Facts

- Endpoint: POST https://payai.agentstools.dev/breach/password
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-password-breach-checker-59202f5e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_LYf0Cc3SjlVF3Mmw6RrtO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-password-breach-checker-59202f5e -d '<json body>'
```

Example prompt: Can you check if the password 'Tr0ub4dor&3' has ever appeared in a known data breach? I want to know if it's compromised and how many times it's shown up.

## When to prefer this

Choose this endpoint when you need a privacy-safe breach check that never transmits the plaintext password, using k-anonymity to protect the credential during lookup. Prefer this over raw HIBP API calls when you want a managed, pay-per-call integration without handling the SHA-1 hashing and range-query logic yourself. Ideal for agent workflows that need to programmatically screen passwords at registration, audit credential stores, or enforce security policies.

## Known failure modes

- Invalid input format — password, SHA-1 or NTLM hash must be provided in the correct format
- Upstream HIBP API unavailable — service may return an error if the breach database is unreachable
- Empty or null password input — endpoint requires a non-empty credential
- Rate limiting from upstream — excessive calls may result in temporary throttling
- Network timeout — if the k-anonymity upstream query takes too long

## How this service works

Check whether a password has appeared in known data breaches, using k-anonymity: the password is hashed locally and only a 5-character hash prefix is sent upstream, so the plaintext is never transmitted, logged or stored. Accepts a password, a SHA-1 hash or an NTLM hash. Returns compromised, breach_count and the hash prefix. Credential-exposure indicators, not a guarantee.

## Output

Returns a JSON object with: 'compromised' (boolean indicating if the password appears in known breaches), 'breach_count' (integer number of times it appears across breach datasets), and 'hash_prefix' (the 5-character SHA-1 prefix sent upstream). These are credential-exposure indicators and not a guarantee of absolute safety.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ntlm": {
   "type": "string",
   "description": "Alternative input: a full 32-hex NTLM hash (MD4 cannot be computed here, so send the hash for the NTLM corpus)"
  },
  "sha1": {
   "type": "string",
   "description": "Alternative input: a full 40-hex SHA-1 hash of the password (so the plaintext never leaves your side)"
  },
  "password": {
   "type": "string",
   "description": "Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-password-breach-checker-59202f5e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)