Will PureDevKit send my password to HIBP?

No. This is documentation only. If you implement the range API, hash on the device and send only the five-character prefix to api.pwnedpasswords.com.

API guides/Security

Free

Have I Been Pwned passwords API

k-anonymity range API: send the first 5 characters of a SHA-1 hash, never the password. Free. Email search is a different, paid product.

Check official docs

1 provider · 5 min · Limits change — verify before you ship

Security

What this is for

HIBP’s Pwned Passwords endpoint is designed so the full password never leaves your process: hash locally, query by prefix, match suffixes yourself. That is different from searching an email for breaches, which requires a paid key.

HIBP Pwned Passwords (range)

Free

GET https://api.pwnedpasswords.com/range/{first5}

Official docs

HTTPS

Yes

API key

No key

CORS

Usually yes

Use

Free tier

Limits. Public range API. Follow Troy Hunt’s current guidance; add padding as documented.

Commercial. Pwned Passwords range is free. Breach search by account is paid.

Note. Response is text, not JSON: SUFFIX:count per line. Compute SHA-1 in Web Crypto or your backend. Never log the password or the full hash to our site — we do not offer a live checker.

curl -sS "https://api.pwnedpasswords.com/range/21BD1"

PureDevKit does not host or proxy these APIs. Pricing, rate limits, CORS, authentication, and JSON shapes can change without notice. Always confirm the current rules on the provider’s official documentation before you ship.

Have I Been Pwned passwords API

What this is for

HIBP Pwned Passwords (range)

Frequently asked questions

Related tools

Hash Generator

Password KDF

Passphrase