Skip to content
Finowl

FINOWL INTELLIGENCE / PASSWORD BREACHES

A fresh start, not an exposed password.

Check a password against known exposures before accepting it. Get a breach flag and an occurrence count to inform your password policy.

Start buildingTry the sandbox
Isometric password shield connected to a hash-prefix lookup and occurrence result.

HOW IT WORKS

A hash-prefix lookup.
A clear boundary.

The upstream lookup never receives the plaintext password, only a short hash prefix.
STEP / 01

Send a password

Your application sends the candidate password to Finowl over HTTPS, authenticated with your API key.

STEP / 02

Hash and look up

Finowl hashes it and shares only the first five characters of the SHA-1 hash upstream.

STEP / 03

Get an occurrence count

Finowl compares the returned matches and responds with a breached flag and a known occurrence count.

SEE IT IN ACTION

Known exposure,
not a strength score.

Finowl Intelligence

POST/v1/breaches/password

RequestcURL
curl https://api.finowl.co/v1/breaches/password \  -H "Authorization: Bearer $FINOWL_API_KEY" \  -H "Content-Type: application/json" \  --data '{    "password": "example-test-password"  }'
ResponseJSON200 OK
{  "breached": false,  "count": 0}

WHERE IT FITS

Check when a
password is chosen.

  • At signup

    Check a proposed password for known exposure before it becomes part of a new account.

  • On password changes

    Make known-exposure checks part of your password-change policy alongside your existing requirements.

  • During recovery

    Check a replacement password when someone resets their credentials and starts again.

Keep your existing strength requirements and authentication protections. An exposure check adds to them; it does not replace them.

THE RESPONSE

Two fields. One clear signal.

A password can meet your length requirements and still appear in exposure data. Use the result to request a different password when appropriate.

Finowl receives the password to perform the check, so treat these requests as sensitive and keep passwords out of your application logs.

breached
Whether the password has a match in the available known-exposure data.
count
How many known occurrences were found. No match is reported as zero, not as a guarantee of safety.

A FEW GOOD QUESTIONS

Password breach questions, answered.

Make exposure checks part of your policy.

Check new and replacement passwords for known occurrences.

Start buildingView pricing