# Pwned Password Check

> Pwned Password Check is a paid API for AI agents from 164.160.90.241.sslip.io, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-12).

Checks whether a password has appeared in known data breaches using the Have I Been Pwned k-anonymity range API, returning the breach count without exposing the full hash.

## Facts

- Endpoint: GET https://164.160.90.241.sslip.io/api/sec-haveibeenpwned-hash-lookup?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pwned-password-check-c76924c1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Lqj0ojXuLB083mzRmht5T

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pwned-password-check-c76924c1
```

Example prompt: Can you check if the password 'Hunter2!' has ever appeared in a known data breach? Compute its SHA-1 hash and run it through the Have I Been Pwned k-anonymity lookup.

## When to prefer this

Choose this endpoint when you need privacy-safe password breach checking using k-anonymity — meaning the full password hash never leaves your server and is never sent to a third party. Ideal for agents enforcing password security policies, auditing credential lists, or blocking compromised passwords at registration. Prefer this over direct HIBP API calls when you want a managed, paid-per-call service that handles the range API logic for you.

## Known failure modes

- Invalid or malformed SHA-1 hash (not 40 hex characters) — returns an error response
- Network timeout reaching the upstream Have I Been Pwned API — may return a 502 or 504
- Rate limiting by the upstream HIBP range API — may return an error if called excessively
- Non-hex characters in the hash parameter cause a bad request error
- HIBP service outage results in unavailable response

## How this service works

Check whether a password's SHA-1 hash appears in known breaches (Have I Been Pwned range API, k-anonymity, the full hash never leaves our server). Returns breach count.

## Output

Returns the number of times the given password's SHA-1 hash has appeared across known breach datasets. A count of zero means the password was not found in any breach. A non-zero count indicates how many times it has been seen, allowing the caller to assess compromise risk. The k-anonymity model ensures only the first 5 characters of the SHA-1 hash are transmitted externally.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "hash"
     ],
     "properties": {
      "hash": {
       "type": "string",
       "description": "Uppercase or lowercase SHA-1 hex of the password"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pwned-password-check-c76924c1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 164.160.90.241.sslip.io](https://www.zero.xyz/host/164.160.90.241.sslip.io/llms.txt)