Pwned Passwords API
- Status
- Working
- API key
- Not needed
- Browser calls
- Runs in the browser
- Latency
- 75 ms
Build snapshot, not live. One verifier run on , from the machine that built this site. How we check
Example request
GEThttps://api.pwnedpasswords.com/range/21BD1
Sent from your browser straight to api.pwnedpasswords.com. No proxy: this site never sees the request or the answer.
Copy the request
curl -s 'https://api.pwnedpasswords.com/range/21BD1'const res = await fetch("https://api.pwnedpasswords.com/range/21BD1");
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.text();
console.log(data);import requests
res = requests.get("https://api.pwnedpasswords.com/range/21BD1", timeout=10)
res.raise_for_status()
print(res.text)Response stored by the verifier
This is what api.pwnedpasswords.com answered when the verifier sent the request above on : HTTP 200, text/plain. Arrays are cut to two items and long strings are shortened. It comes from the build snapshot.
0002EEFFB2CCA91812B5CC9956854E22BEB:4
000F6468C6E4D09C0C239A4C2769501B3DD:5959
00115AE168591C338025516216655E42A09:17
0018A45C4D1DEF81644B54AB7F969B88D65:9
0067AD792FB5BA36BECEF3506EE21E41DD9:59
009F8BAECE04D85D02A358D8BAF99819D2F:10
00BF5B8932DFD00FDB4A9529E7923068928:4
00CF63A94500831584A7BBAB1CCF86CBE17:70
00D4F6E8FA6EECAD2A3AA415EEC418D38EC:3
011053FD0102E94D6AE2F8B83D76FAF94F6:1
012A7CA357541F0AC487871FEEC1891C49C:13
0136E006E24E7D152139815FB0FC6A50B15:5
01561D5D4D893ADDA894DD9484C145323E3:1
015FEFCF71A10576F1CDEBD4F3D3345903E:87
01652BCE1DC981714BEC1E76B40B79C2FB5:1
017E166DC997380CA0E599165FBDD311D15:2
01A85766CD276B17DE6DA022AA3CADAC3CE:8
01AD71778A9392B21AEB399813DFDF9E8C2:1
01AE785F69EA173E9077190C63B17072399:1
01B13C6C273B75F11356FF4EBD41D21B521:3
021F208BB1EC3752C3798E1D974D2A4CDFA:2
024067E46835A540D6454DF5D1764F6AA63:5
0240C891234CEFA6176C81842ED1AB77988:1
02551CADE5DDB7F0819C22BFBAAC6705182:47
025B243055753383B479EF34B44B562701D:4
026124BC8264FE5307570D0483540004C1A:2
0277B7291962213849A80F48D8B5752E022:3
02A56D549B5929D7CD58EEFA97BFA3DDDB3:42
02BD0AF51FC2D02ABDE9B3241D84A613811:50
02E300D40DD40E56122A20B59A4D9CA45EB:1
02F1C470B30D5DDFF9
…Availability
Up 1 of 1 day checked · 30-day window
What counts as up for this API: an answer within five seconds, a 2xx status, and the body must contain ":".
Last check: — passed, HTTP 200 in 75 ms.
The check runs from our infrastructure, not from where you are. If you need certainty, send the request yourself above. How the verifier works.
Questions
Does the Pwned Passwords API need an API key?
No. The sample request on this page was answered without a key, token or account.
Can I call the Pwned Passwords API from the browser?
Yes. api.pwnedpasswords.com answered our verifier with an Access-Control-Allow-Origin header on Oct 3, 2026, so a fetch call from a web page can read the response.
Is the Pwned Passwords API working?
At the check on Oct 3, 2026 it returned HTTP 200 with the expected data in 75 ms. The status at the top of this page shows the most recent result we have.