Breach detection API

Check whether a supported identifier appears in known data breaches.

Return the available breach details as context for account security and record review.

Part of: KYC waterfall Affiliate fraud detection Source audit

Try it free from £0.012 per request, down to £0.003 at volume

What it checks

Choose the identifier type, send the value, and Provero searches known breach data for it.

Each request searches one value of one type. The supported types are:

email: an email address.
username: an account username.
phone: a phone number.
domain: a domain name.
password: the full 40-character SHA-1 hash of the password, never the plaintext password.

A search covers the breach data available to Provero. It cannot cover every breach that has ever happened, so a result reflects what is known rather than a complete history.

How password searches work

You send Provero the full 40-character SHA-1 hash of the password. You never send the plaintext password.

Hash the password in your own system and send the hash as the value, with type set to password. A value that is not a valid 40-character SHA-1 hash is rejected with a validation error. The code examples in the API reference include the hashing step.

Provero then handles the partial-hash exchange with the upstream breach source: only a small portion of the hash is used for the upstream search, and the full match is confirmed on Provero's side.

What comes back

The response repeats the type and value you searched and returns a leaks list, with one entry for each matching breach.

Breach name

The service or dataset the identifier was exposed in.
Domain

The domain associated with the breached service.
Breach date

When the breach occurred, so you can tell recent exposure from older history.
Description

A short description of the breach and the type of data exposed.

Not every breach carries every detail. Where a field is not available for a breach, it is returned as null.

Breach dates across a lead source

Our Breach Age Index article looks at how breach rates and breach dates are spread across whole lead sources, based on the samples it describes. It is a source-level analysis, not a test for a single record.

Read the Breach Age Index article

When to use it

At sign-up or login, to decide whether an exposed account should get a password-change prompt or extra verification.
When someone sets a password, to check its hash against known breached passwords before accepting it.
When reviewing records or lead sources, to add breach history as context alongside your other checks.
In bulk, to see exposure across an existing list.

What a result does not show

Exposure is not proof of fraud. Ordinary, long-used email addresses and phone numbers often appear in breach data.
No exposure found is not a verified identity. It means no match was found in the breach data searched.
An exposure belongs to the identifier searched, not to whoever holds it today. Phone numbers and email addresses can be reassigned or change hands.
A breach date shows when the breach happened. Compare it with what you know about the record, but do not treat a date on its own as proof that data was stolen or made up.

How to read the result

Result	Meaning	What to do
No breaches returned	Meaning: No matching breach was found in the data searched.	What to do: Carry on with your normal checks. This does not verify the person.
One or more breaches	Meaning: The identifier appears in the breaches listed.	What to do: Read the dates and descriptions, and use them as context for a security prompt or a review.
Recent breach on an account identifier	Meaning: The email address, username or phone number was exposed recently.	What to do: Consider a password-change prompt or step-up verification.
Password hash found	Meaning: That password appears in known breach data.	What to do: Ask the person to choose a different password.
Older breach history	Meaning: The identifier has been exposed in the past, which is common for addresses and numbers that have been in use for years.	What to do: Compare the history with the rest of the record. Review it where the two do not fit together.

API & bulk usage

Call the Breach detection API with a type and a value. For type password, the value is the full SHA-1 hash. Use the bulk uploader to check an existing list, or include Breach detection in a Multi-validation request alongside other checks.

Example request and response

POST https://api.provero.io/api/fraud-check/breach

Request (email search)

{
  "type": "email",
  "value": "jane.smith@example.com"
}

Response

{
  "value": "jane.smith@example.com",
  "type": "email",
  "leaks": [
    {
      "name": "Adobe",
      "domain": "adobe.com",
      "breachDate": "2013-10-04",
      "description": "User profile and password hints were exposed."
    }
  ]
}

Illustrative address and values, not the result of a live check; the breach shown is the example from the API documentation. For a password search, send type password and the full 40-character SHA-1 hash as the value.

View breach detection API documentation

Pricing

from £0.012 per request, down to £0.003 at volume

Requests / month	Rate
0 – 5,000	£0.012
5,001 – 10,000	£0.008
10,001 – 25,000	£0.007
25,001 – 50,000	£0.006
50,001 – 100,000	£0.0045
100,001 – 300,000	£0.004
300,001 – 500,000	£0.0035
500,001+	£0.003

Paid from a prepaid balance that you can spend across any check. See current rates.

Need volume pricing? Email pricing@provero.io.

Related checks

No single check settles whether a record can be trusted. These are the ones people usually run alongside Breach detection, each answering a different question about the same record.

See every Provero check →

Breach detection FAQ

Which identifiers can I search?

Email address, username, phone number, domain and password. Set type to email, username, phone, domain or password and send the value to search. For a password, the value is the full SHA-1 hash.

How do I search a password without sending it?

Hash the password in your own system and send the full 40-character SHA-1 hash as the value, with type set to password. Never send the plaintext password. Provero handles the lookup with the upstream breach source using only a small portion of the hash, and confirms the full match on its side.

Why are some breach details missing?

Not every breach record includes a name, domain, date and description. Where a detail is not available for a breach, the field is returned as null, so build your rules so they do not depend on every field being present.

Does a search cover every breach?

No. It covers the known breach data available to Provero. A result with no breaches means no match was found in that data, not that the identifier has never been exposed.

Does a breach result mean a record is fraudulent?

No. Many genuine people's email addresses and phone numbers appear in breach data. A result shows that the identifier was exposed. It does not show who holds the identifier today, and no exposure found does not verify an identity either. Use the result as context alongside your other checks.

How should I read the breach date?

It shows when the breach happened. A recent breach on an account identifier is a reason to consider a password-change prompt or extra verification. Older history is common for identifiers that have been in use for years; compare it with the rest of the record rather than drawing a conclusion from the date alone.

How much does Breach detection cost?

It starts at £0.012 per request and steps down to £0.003 at volume on a prepaid, graduated balance, with free credits to run a real sample of your own data through every check.

Start with this check

Create a free account, claim your credits and run Breach detection through the API or bulk upload. No card required.