Password Breach API

Getting started

Subscribe, copy your secret key, and run your first password breach check.

The Syndaq Password Breach API checks a password against Syndaq breach intelligence. Successful responses include only breached and count—the API never echoes the password back.

v1 scope: checks against Syndaq breach intelligence. Call from your backend only; never embed passwords or secret keys in browsers or mobile apps.

What you need

  1. A Password Breach plan from the Syndaq API catalog.
  2. A secret key (pb_sec_) from the Syndaq client area after your order is provisioned.

Password checks are server-side only. Send your secret key and the password from your backend or trusted worker.

Base URL

All Password Breach endpoints are served from:

https://api.syndaq.com/v1/pwbreach/

Quick start

Replace pb_sec_YOUR_SECRET_KEY with the secret shown in Services for your Password Breach subscription.

curl -sS "https://api.syndaq.com/v1/pwbreach/lookup" \
  -H "Authorization: Bearer pb_sec_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password":"YOUR_PASSWORD_HERE"}'

A successful response includes breached (boolean) and count (integer). If breached is true, reject or require a stronger password.

How lookups work

StepWhat happens
1Authenticate with your secret key.
2POST a password (or an allowed hash form) to the lookup endpoint.
3Receive JSON with breached and count (including a cached flag when Syndaq already holds a recent result).

Do not log the password in your application. Prefer TLS end-to-end to https://api.syndaq.com.

Manage your subscription

Sign in to the Syndaq client area and open Services. Select your Password Breach service to:

  • View usage and remaining monthly quota
  • Copy or rotate your secret key
  • Configure optional IP allowlists for API access

Next steps