{ "openapi": "3.1.1", "info": { "title": "Private Breach Checker API", "version": "1.0.0", "summary": "Check if a password appears in known breaches without revealing it (k-anonymity).", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://privatebreachchecker.usefulweb.site" } ], "paths": { "/api/v1/calculate": { "post": { "operationId": "calculate", "summary": "Check if a password appears in known breaches without revealing it (k-anonymity).", "description": "Checks a password against the Have I Been Pwned Pwned Passwords collection using k-anonymity: your browser hashes the password with SHA-1 and sends only the first 5 of 40 hex characters; the match is done locally. The server and API accept only a SHA-1 hash or 5-character prefix, never a password.\n\nMethodology:\n- The password is hashed with SHA-1 (uppercase hex). Only the first 5 hex characters (20 bits) are sent to https://api.pwnedpasswords.com/range/; the service returns every known hash suffix with that prefix (typically 800–1,000) and how often each appeared in breaches.\n- Requests use the Add-Padding header, so the response contains random zero-count entries and its size reveals nothing; padding entries are ignored.\n- With JavaScript on, hashing, the range request and the comparison all happen in your browser; our server is not involved. If your browser cannot reach the service directly, the page asks our API for the same 5-character range and still compares locally.\n- The server path (no JavaScript, API, MCP) accepts only a 40-character SHA-1 hash or a 5-character prefix and rejects anything else, so a password can never be submitted by mistake. With a full hash, the server sees the hash (not the password) and sends only the prefix onwards.\n- Not found does not prove a password is strong: it only means it is not in this breach corpus.\n\nIf a password appears in a breach, stop using it everywhere and change it. Use a password manager and unique passwords.", "tags": [ "crypto" ], "x-mcp-tool": "private_breach_checker", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PrivateBreachCheckerInput" }, "examples": { "example1": { "summary": "SHA-1 of the password \"password\"", "value": { "hash": "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8" } }, "example2": { "summary": "Range lookup for prefix 21BD1 (k-anonymity)", "value": { "hash": "21BD1" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PrivateBreachCheckerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tool": { "get": { "operationId": "getToolDefinition", "summary": "Inputs, output schema and examples for this tool", "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "PrivateBreachCheckerInput": { "type": "object", "additionalProperties": false, "properties": { "hash": { "title": "SHA-1 hash or 5-character prefix", "description": "Hex only. Never enter a password here. With JavaScript on, use the password box above: it is hashed in your browser.", "type": "string", "maxLength": 64 } }, "required": [ "hash" ] }, "PrivateBreachCheckerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "prefix", "mode", "found", "breachCount", "rangeEntries", "paddingEntries", "suffixes", "retrievedAt" ], "properties": { "prefix": { "type": "string", "description": "The only part of the hash sent to Have I Been Pwned." }, "mode": { "type": "string", "enum": [ "full-hash", "prefix-only" ] }, "found": { "type": [ "boolean", "null" ], "description": "null when only a prefix was given." }, "breachCount": { "type": [ "integer", "null" ], "description": "How often the password appears in the breach corpus (0 = not found)." }, "rangeEntries": { "type": "integer", "description": "Real hash suffixes returned for the prefix." }, "paddingEntries": { "type": "integer", "description": "Fake zero-count entries added by Add-Padding." }, "suffixes": { "type": [ "array", "null" ], "description": "Prefix-only mode: all suffixes with counts so the caller can match locally.", "items": { "type": "object", "additionalProperties": false, "required": [ "suffix", "count" ], "properties": { "suffix": { "type": "string" }, "count": { "type": "integer" } } } }, "retrievedAt": { "type": "string" } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }