Pwned Passwords Hash Range Search

pwnedpasswords/range-search

Breached-password lookup by k-anonymity. Send only the first 5 hex characters of the SHA-1 hash of a password, never the password itself; the input is refused unless it is exactly 5 hex characters. Returns every known breached hash suffix in that range with how many times it appeared in breaches; compare the remaining 35 characters of your hash locally. Data from Have I Been Pwned (Pwned Passwords), https://haveibeenpwned.com/Passwords, CC BY 4.0, served by Eden Engine; not an official Have I Been Pwned product.

activeper callv1

Price

$0.0026 per call

You pay the price shown. If a call turns out to cost more than its quote, you pay the actual price, capped at twice the quote. No monthly minimum. Top-ups start at $0.50.

Data source

Have I Been Pwned (Pwned Passwords)

Breached-password hash ranges from Have I Been Pwned's Pwned Passwords service, https://haveibeenpwned.com/Passwords, by Troy Hunt, whose Pwned Passwords data is released under Creative Commons Attribution 4.0 (https://creativecommons.org/licenses/by/4.0/). Passed through, reshaped into a list, and served by Eden Engine; this is not an official Have I Been Pwned product, and Have I Been Pwned does not endorse it.

Use it

Five steps: search, inspect, learn, run, settle. No per-tool setup; your agent reaches this tool through the meta-tools it already has.

Connect once and your AI can find and run this tool, and any other it needs.

Install it Create an account

agent

// 1. search: find the tool
omnial_search({ query: "what you need" })

// 2. inspect: price and input schema
omnial_inspect({ tool: "pwnedpasswords/range-search" })

// 3. learn: read the usage guide at runtime
omnial_learn({ tool: "pwnedpasswords/range-search" })

// 4. run: price the exact call first, then run it
omnial_execute({ tool: "pwnedpasswords/range-search", input: { /* see input_schema */ }, dry_run: true })
omnial_execute({ tool: "pwnedpasswords/range-search", input: { /* ... */ } })

// 5. settle: the call is charged when it finishes, nothing to do

Not connected yet? Point your MCP client at https://mcp.eden-engine.com/mcp, then copy a config for your client.

Pricing

Every charge this tool can incur.

Charge	Price
Per call	$0.0026

Updated: Oct 26, 2026

Input and output schemas

Input schema

input_schema.json

{
  "type": "object",
  "required": [
    "prefix"
  ],
  "properties": {
    "prefix": {
      "type": "string",
      "pattern": "^[0-9A-Fa-f]{5}$",
      "description": "Exactly the first 5 hexadecimal characters of the SHA-1 hash of the password, for example 21BD1. Anything else, including a password or a full hash, is refused."
    }
  },
  "additionalProperties": false
}

Output schema

output_schema.json

{
  "type": "object",
  "required": [
    "results"
  ],
  "properties": {
    "results": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "suffix",
          "count"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "description": "How many times this password appeared in breaches."
          },
          "suffix": {
            "type": "string",
            "description": "The remaining 35 hex characters of a breached SHA-1 hash, upper case."
          }
        },
        "additionalProperties": true
      },
      "description": "Breached hash suffixes in the range."
    }
  },
  "additionalProperties": true
}