Pwned Passwords
App · Compliance & Security · 4 actions
Check passwords against Pwned Passwords, Have I Been Pwned's free list of passwords exposed in real data breaches. Turn away a breached password at sign-up or reset, or audit a whole list of accounts, including NTLM hashes from Active Directory. Passwords never leave Lodol: each is hashed and only the first five characters of the hash are sent. No account or API key required.
Actions
| Action | What it does |
|---|---|
| Check a password | Check whether a password has appeared in a known data breach, and how many times. |
| Check a password hash | Check whether a SHA-1 or NTLM password hash belongs to a password that has appeared in a known data breach, and how many times, without ever knowing the password. |
| Check several password hashes | Audit up to 1,000 SHA-1 or NTLM password hashes at once, such as an Active Directory hash dump, and find the accounts whose passwords have appeared in data breaches. |
| Check several passwords | Check up to 1,000 passwords at once, such as an export of accounts, and find the ones that have appeared in data breaches. |
Check a password
Check whether a password has appeared in a known data breach, and how many times. Use it to turn away a breached password at sign-up or password reset. The password never leaves Lodol: it is hashed and only the first five characters of the hash are sent, and it is not repeated in the result. A password that has never been breached is not necessarily a strong one. No API key required.
Inputs
- Password
passwordtextRequired - The password to check, usually from an earlier step such as a sign-up form. It is checked exactly as given, spaces included. It never leaves Lodol: it is hashed here and only the first five characters of the hash are sent to Pwned Passwords.
Outputs
pwnedtrue/false- True when the password has appeared in a data breach.
summarytext- The answer as one plain sentence.
times_seennumber- How many times the password appears in breach data, 0 when never. The higher it is, the more likely attackers are to try it.
Example output
{
"pwned": true,
"summary": "This password has appeared in data breaches 52,372,427 times. It should not be used.",
"times_seen": 52372427
}Check a password hash
Check whether a SHA-1 or NTLM password hash belongs to a password that has appeared in a known data breach, and how many times, without ever knowing the password. NTLM is the hash Windows and Active Directory store. The kind of hash is worked out from its length. No API key required.
Inputs
- Password hash
password_hashtextRequired - A SHA-1 hash (40 characters) or an NTLM hash (32 characters, the kind Windows and Active Directory store). Which one it is is worked out from its length, and upper or lower case both work. Other kinds of hash, such as MD5 or bcrypt, cannot be checked.
Outputs
hashtext- The hash that was checked, in upper case.
hash_typetext- 'SHA-1' or 'NTLM'.
pwnedtrue/false- True when the password has appeared in a data breach.
summarytext- The answer as one plain sentence.
times_seennumber- How many times the password appears in breach data, 0 when never. The higher it is, the more likely attackers are to try it.
Example output
{
"hash": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8",
"hash_type": "SHA-1",
"pwned": true,
"summary": "This SHA-1 hash belongs to a password that has appeared in data breaches 52,372,427 times. It should not be used.",
"times_seen": 52372427
}Check several password hashes
Audit up to 1,000 SHA-1 or NTLM password hashes at once, such as an Active Directory hash dump, and find the accounts whose passwords have appeared in data breaches. Windows hash dump lines and account:hash lines are read as they are, so each result names its account. The result also lists only the breached ones and says whether any were. An entry that is not a hash is skipped and reported rather than stopping the step. No API key required.
Inputs
- Password hashes
password_hasheslistRequired - Up to 1,000 SHA-1 or NTLM hashes: a list from an earlier step, or pasted text with one per line. A line can name its account as account:hash, and the lines of a Windows hash dump (account:RID:LM hash:NT hash:::) are read as they are, so an Active Directory audit can be pasted straight in. Rows from a spreadsheet work too: the hash is read from a column named hash, NTLM or SHA-1, and the account from a column such as username or email.
Outputs
any_pwnedtrue/false- True when at least one of them has appeared in a data breach.
checked_countnumber- How many entries were checked.
not_checkedlist- Entries that could not be checked, such as a blank row, each with its position, its account if known, and the reason.
pwned_countnumber- How many of them have appeared in a data breach.
pwned_resultslist- Only the hashes whose passwords have been breached.
resultslist- Every hash checked, in the order given.
summarytext- The answer as one plain sentence.
Example output
{
"any_pwned": true,
"checked_count": 1,
"not_checked": [],
"pwned_count": 1,
"pwned_results": [
{
"hash": "8846F7EAEE8FB117AD06BDD830B7586C",
"hash_type": "NTLM",
"label": "CORP\\alice",
"position": 1,
"pwned": true,
"times_seen": 52372427
}
],
"results": [
{
"hash": "8846F7EAEE8FB117AD06BDD830B7586C",
"hash_type": "NTLM",
"label": "CORP\\alice",
"position": 1,
"pwned": true,
"times_seen": 52372427
}
],
"summary": "The hash checked has appeared in data breaches."
}Check several passwords
Check up to 1,000 passwords at once, such as an export of accounts, and find the ones that have appeared in data breaches. Each is reported by its position and, when the rows name one, its account, never by the password itself. The result also lists only the breached ones and says whether any were, so a workflow can act on them directly. A blank row is skipped and reported rather than stopping the step. No API key required.
Inputs
- Passwords
passwordslistRequired - Up to 1,000 passwords: a list from an earlier step, or pasted text with one password per line. Rows from a spreadsheet or form work too: the password is read from a column named password, and the account from a column such as email or username, so the results say whose password was breached. Passwords are never sent anywhere or repeated in the results.
Outputs
any_pwnedtrue/false- True when at least one of them has appeared in a data breach.
checked_countnumber- How many entries were checked.
not_checkedlist- Entries that could not be checked, such as a blank row, each with its position, its account if known, and the reason.
pwned_countnumber- How many of them have appeared in a data breach.
pwned_resultslist- Only the passwords that have been breached.
resultslist- Every password checked, in the order given.
summarytext- The answer as one plain sentence.
Example output
{
"any_pwned": true,
"checked_count": 2,
"not_checked": [],
"pwned_count": 1,
"pwned_results": [
{
"label": "alice@example.com",
"position": 1,
"pwned": true,
"times_seen": 52372427
}
],
"results": [
{
"label": "alice@example.com",
"position": 1,
"pwned": true,
"times_seen": 52372427
},
{
"label": "bob@example.com",
"position": 2,
"pwned": false,
"times_seen": 0
}
],
"summary": "1 of 2 passwords has appeared in data breaches."
}