Is the password sent to Finowl in plain text?

It is sent over TLS to Finowl, which hashes it and queries only a 5-character hash prefix. The password is processed transiently and never logged, stored or returned.

What threshold should an exchange use?

Many crypto platforms reject any breached password because the downside of a takeover is severe. Adjust if you see too much friction, but start strict.

Are failed checks charged?

Requests rejected before running, such as a 400, are free. Uncertain failures like timeouts may have run and may be charged, so avoid blind retries.

Password breach checks · Crypto exchanges

Breached password checks for crypto wallets and exchanges

Credential stuffing works because people reuse passwords, and the payoff from a crypto account makes exchanges a favorite target. Blocking passwords that already appear in breach data removes the credentials attackers try first. Finowl returns whether a password has been seen and how often, so you can reject widely circulated values outright and nudge users away from rarer ones, in line with NIST SP 800-63B guidance.

Security-conscious crypto users will ask how their password is handled. Finowl hashes it with SHA-1 and queries only a 5-character hash prefix through a padded k-anonymity range search. The password is processed transiently and is never logged, stored or returned. You can describe that design in your security documentation, which helps when users and auditors question third-party integrations.

Try it in the sandbox About password breaches

USE CASES

Where it fits in crypto exchanges

Signup password policy
Reject any new exchange password that appears in breach data, and suggest a long passphrase from a password manager, so accounts holding funds never start with a known compromised credential.
Forced reset after incidents
If you detect a credential stuffing wave, check passwords at the next successful login and require an immediate reset for accounts whose current password appears in breach data.
Withdrawal password screening
Some platforms use a separate withdrawal or anti-phishing password. Apply the same breached-password check when users set it, since it protects the most sensitive action on the account.
Wallet app account protection
For custodial wallet apps with email and password login, screen passwords at creation and change to reduce takeover risk on accounts that can send funds.

HOW TO INTEGRATE

The workflow

1
In your auth service, send the candidate password to POST /v1/breaches/password before hashing it for storage.
2
Block the password if breached is true and count exceeds your threshold, which many exchanges set at any match.
3
Show a short explanation and a link to choose a password manager generated passphrase.
4
On timeouts or 5xx responses, apply local complexity rules and queue a recheck at the next login.
5
Verify that no proxy, log pipeline or error tracker captures the password field.

POST /v1/breaches/password

curl https://api.finowl.co/v1/breaches/password \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "password": "correct-horse-battery-staple"
}'

Runs when a user sets their exchange or withdrawal password. Any breached result blocks the password because the account protects funds that cannot be recovered on chain.

GOOD PRACTICE

Before you ship

Strict thresholds suit crypto. Because funds are hard to recover, many exchanges block any password seen in breach data, even with a low count.
Treat passwords as secrets across your stack. Redact them in logs, traces and analytics, and run the check only from servers you control.
Pair password checks with phishing-resistant two-factor authentication. A strong password alone does not stop phishing kits or malware on a user's device.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions