# ShieldAPI k-Anonymity Password Range Lookup

> ShieldAPI k-Anonymity Password Range Lookup is a paid API for AI agents from shield.vainplex.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Checks a SHA-1 password hash prefix against a breach database using k-anonymity, returning matching hash suffixes and breach counts (HIBP-compatible)

## Facts

- Endpoint: GET https://shield.vainplex.dev/api/check-password-range
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/shieldapi-k-anonymity-password-range-lookup-3e6e3ce3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_N_95QDzcMI5X5ah4H1UTt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability shieldapi-k-anonymity-password-range-lookup-3e6e3ce3
```

Example prompt: Can you check if the password 'Summer2024!' has appeared in any known data breaches — use the k-anonymity hash range method so the actual password stays private?

## When to prefer this

Use this endpoint when you need to check password exposure in a privacy-preserving way using the k-anonymity model — ideal for credential validation flows, security audits, or user onboarding checks where you cannot send the full password hash to a remote server. Prefer this over a full-hash lookup when privacy is paramount. It is HIBP-compatible, so existing tooling that works with HIBP range responses will work here.

## Known failure modes

- Missing or too-short prefix (fewer than 5 hex characters) returns a 400 error
- Invalid non-hex characters in prefix cause a validation error
- Payment not provided or insufficient USDC triggers a 402 Payment Required response
- Service unavailable or upstream breach database unreachable returns 5xx
- Demo mode may return limited or synthetic data not representative of full dataset

## How this service works

k-Anonymity password range lookup (HIBP compatible)

## Output

Returns a list of SHA-1 hash suffixes that match the submitted prefix, each paired with a count indicating how many times that password hash appeared across known breach datasets, allowing the caller to check locally whether their specific full hash is in the list without exposing it.

## Example request

```json
{
 "demo": true,
 "prefix": "5BAA61"
}
```

## Request schema (JSON Schema)

```json
{
 "properties": {
  "input": {
   "required": [
    "method"
   ],
   "properties": {
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/shieldapi-k-anonymity-password-range-lookup-3e6e3ce3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from shield.vainplex.dev](https://www.zero.xyz/host/shield.vainplex.dev/llms.txt)