Breach Detection API

Know if an identity is already exposed, check emails, phones, IPs, usernames, domains and passwords against known breach data.

Try it free from £0.012 per request, down to £0.003 at volume

What it checks

Breach Detection checks whether an identifier appears in known data breaches, and returns the breaches it found. You can check an email, phone number, IP, username, domain or password. For passwords it uses a privacy-preserving approach: you never send the plaintext password. Only a partial SHA-1 hash is used for the upstream lookup, with the full match confirmed by hash, so the password itself is never transmitted. It tells you that an identifier has been exposed before, useful context for risk scoring and account security. Crucially, it's a signal, not a verdict: many ordinary people appear in old breaches, so the value is in how you weigh it alongside breach age and your other checks.

What it returns

List of known breaches , per identifier, every matching breach found
Supported identifiers , email, phone, IP, username, domain or password. Set the type in the request
Privacy-preserving password check , plaintext passwords are never sent; only a partial SHA-1 hash is used upstream, with the full match confirmed by hash
Breach name , the service or dataset the identifier was exposed in
Domain , the domain associated with the breached service
Breach date , when the breach occurred, so you can weigh how recent it is
Description , a short description of what the breach involved

When to use it

At sign-up or onboarding, as one input into an account-security or risk score.
In fraud and KYC pre-screening, to weigh exposure alongside other signals before a record becomes trusted evidence.
When assessing list or lead quality, where patterns of breach exposure can indicate recycled or scraped data.
To prompt step-up security, for example encouraging a password reset or extra verification on exposed accounts.

When not to use it

As proof that someone is fraudulent, appearing in a breach is extremely common and is not, on its own, evidence of wrongdoing.
As proof that someone is real, absence from breach data doesn't confirm a genuine identity either.
Without weighing breach age, a single old breach is very different from recent, repeated exposure; read the dates.
As a standalone decision, it's most useful combined with IP fraud, email and name signals, not used in isolation.

How to read the result

Treat breach exposure as one risk signal among many, and weigh it by recency and pattern rather than presence alone.

No breaches found: No known exposure for this identifier. A mildly positive signal, but not proof of a genuine identity on its own.
One old breach: Very common and low-concern. Most real, long-standing identities appear in at least one historical breach.
Recent or multiple breaches: Worth more weight, especially combined with other risk signals. Consider step-up verification or closer review.
Breach pattern across a list: If many records share the same breach signature, the source may be scraped or recycled data, investigate provenance.

Pricing

from £0.012 per request, down to £0.003 at volume

Requests / month	Rate
0 – 5,000	£0.012
5,001 – 10,000	£0.008
10,001 – 25,000	£0.007
25,001 – 50,000	£0.006
50,001 – 100,000	£0.0045
100,001 – 300,000	£0.004
300,001 – 500,000	£0.0035
500,001+	£0.003

Prepaid balance, spent across any check. Each request is charged at the rate for the volume band reached, and earlier requests keep their lower rate. See full pricing.

Need custom pricing? pricing@provero.io

API & bulk usage

Run Breach Detection in real time at sign-up, or in bulk to assess exposure across an existing list. Set the identifier type in the request: email, phone, IP, username, domain or password. For passwords, send a partial SHA-1 hash rather than the plaintext, never the password itself. Call it on its own, or combine it with other checks in a single request and get every signal back in one response.

Read the API reference →

Request

{
  "breach": {
    "type": "email",
    "value": "simon@provero.io"
  }
}

Response

{
  "breach": {
    "value": "simon@provero.io",
    "type": "email",
    "leaks": [
      {
        "name": "Adobe",
        "domain": "adobe.com",
        "breachDate": "2013-10-04",
        "description": "User profile and password hints were exposed."
      }
    ]
  }
}

Common Questions

Breach Detection FAQ

Does a breach hit mean a record is fraudulent?

No. Many legitimate people appear in breach datasets. Provero treats breach exposure as one signal among many, including breach age, duplication and other risk indicators, rather than a verdict.

What identifiers can I check?

You can check an email, phone number, IP, username, domain or password against known breach data. You set the identifier type in the request, and the response lists each matching breach with its name, domain, date and description.

How are passwords checked without exposing them?

You never send the plaintext password. Breach Detection uses a privacy-preserving partial-hash approach: only a small portion of the password's SHA-1 hash is used for the upstream lookup, and the full match is confirmed by hash. The password itself is never transmitted.

Why does the breach date matter?

Recency is only meaningful against a baseline. Normal live traffic carries a breach rate around 50%, with breach ages spread across it, so the presence of breach data on a record is not itself a red flag. The signal is deviation from that spread. One date that sits before the person could plausibly have held that email or phone, earlier than their date of birth, or early enough that they would have been too young to use it, is not a risk score, it is an impossibility. It tells you the contact detail's history does not match the identity attached to it.

Can I use this for account-security prompts?

Yes. A common use is to prompt a password reset or step-up verification when an identifier shows recent or significant breach exposure.

How much does breach detection cost?

It starts at £0.012 per request and steps down to £0.003 at volume on a prepaid, graduated balance, with free credits to run a real sample of your own data through every check.

Start with this check

Create a free account, claim your credits and run Breach Detection as a real-time API or a bulk upload. No card required.