Password Breach Checker

Overview

The password is hashed with SHA-1 on our side and only the first 5 characters of the hash are sent to the Pwned Passwords range API, with response padding on, so the password itself never leaves the request. It is not logged, stored or returned. You can also send the SHA-1 yourself so the plain password never reaches us.

Live Test Password Breach Checker Skill →

The tool

Once your client is connected to the VerveKit server, this appears in its tool list as PasswordBreachChecker. It is read-only and open-world — it fetches and never mutates anything on your side — so most clients call it without asking you to confirm.

Tool call

{
  "name": "PasswordBreachChecker",
  "arguments": {}
}

Connecting

One server URL covers every skill in the catalog, including this one. Authorization is OAuth: the client opens a browser once, and there is no key to paste into a config file.

{
  "mcpServers": {
    "vervekit": {
      "url": "https://api.vervekit.com/v1/mcp"
    }
  }
}

Per-client setup — Claude, Cursor, VS Code, ChatGPT — is on the MCP setup page.

Arguments

These are the properties on the tool's inputSchema, so a well-behaved client validates them before the call is made. Premium arguments are accepted on every plan but only take effect on plans that include them.

Argument	Type	Description
`password`Optional	string	The password to check. Hashed on receipt and never stored. Send this or hash length 0–1024
`hash`Optional	string	The 40-character hex SHA-1 of the password, instead of the password itself

What the model gets back

The result carries a structuredContent object matching the tool's declared outputSchema, so a client reads fields without parsing prose. status is "ok" and error is null on success; a null field means the value was not available for that input, not that the call failed.

Result

{
  "status": "ok",
  "error": null,
  "data": {
    "breached": true,
    "breachCount": 2266543,
    "riskLevel": "critical",
    "inputType": "password",
    "hashPrefix": "CBFDA"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`breached`	boolean	`true`	True when the password appears in the breach corpus
`breachCount`Premium	number	`2266543`	Number of times the password appears in the breach corpus
`riskLevel`Premium	string	`critical`	Exposure bracket: none, low (1-9), medium (10-999), high (1,000-99,999) or critical (100,000+)
`inputType`	string	`password`	Whether a password or a hash was checked
`hashPrefix`	string	`CBFDA`	The 5-character SHA-1 prefix that was sent to the range API

Failure modes

Errors come back as tool errors carrying a sentence the model can act on, not a bare status code. Error handling covers the full list.

Status	What it means
`400` / `422`	The arguments did not validate. The message names the offending one.
`401`	The OAuth session is invalid or expired — reconnect the server.
`403`	Blocked by a key restriction or an IP allow-list. Never a bad identity.
`404`	This skill is not part of VerveKit. Check the catalog.
`429`	Out of credits, or a brief rate limit. The message tells them apart.

A call costs 5 credits each time the tool actually runs; a model that reasons about the tool without calling it costs nothing.

Use cases

Sign-Up and Password Change: Reject or warn on passwords that have appeared in breaches when a user creates an account or changes their password, as NIST SP 800-63B recommends.
Login Risk Scoring: Flag accounts whose current password is known to be breached and prompt a reset before credential stuffing finds them.
Password Audits: Check stored SHA-1 hashes from a legacy system against the breach corpus without handling plain passwords.
Password Managers: Mark saved passwords that have leaked so users know which ones to change first.

Other ways to use Password Breach Checker

Set up Password Breach Checker on VerveKit, or reach the same source a different way. Your VerveKit account and credits work on all of them — one key, one balance.

Call it as a REST APIOne HTTPS endpoint and an x-api-key header, with SDKs for Node, Python and .NET.APIVerve →Reference →

Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.VerveContext →Reference →