Breach Check
Free tierKnow when a credential has appeared in a public breach.
About this API
Query an index of billions of records from public breaches and combolists using k-anonymity so the plaintext never leaves your infrastructure. Returns breach names, dates, exposed data classes, and severity.
Common use cases
Quickstart
Every Zephiel API uses the same base URL, the same key header, and the same error envelope.
curl -X GET "https://zephiel.com/api/v1/breach-check/email/8.8.8.8" \
-H "X-Zephiel-Key: $ZEPHIEL_API_KEY" \
-H "Accept: application/json"Example response
{
"found": true,
"breach_count": 3,
"breaches": [
{ "name": "Collection #1", "date": "2019-01-07", "classes": ["emails", "passwords"] }
],
"severity": "high"
}/v1/breach-check/email/{hash}Breaches for a hashed email prefix/v1/breach-check/password/range/{prefix}k-anonymity password range query/v1/breach-check/domain/{domain}Exposure summary for a domainAll endpoints return JSON and accept the X-Zephiel-Key header. Rate limits are enforced per plan and reported in X-RateLimit-Remaining.
Plans can be changed or cancelled at any time. Overage is charged per 1,000 requests rather than hard-blocking your traffic.
Free
100 requests/mo
5 req/min
Free
- JSON output format — included
- HTTPS encryption — included
- API key authentication — included
- Standard endpoints — included
- Community support — included
- CSV output format — not included
- Email support — not included
- Usage analytics and alerts — not included
- 99.9% uptime SLA — not included
- Webhooks — not included
- Priority support — not included
- Custom rate limits — not included
- 99.99% uptime SLA — not included
- Dedicated success manager — not included
- SSO / SAML — not included
- Custom SLA, DPA, and BAA — not included
- Private deployment option — not included
- Volume pricing — not included
Starter
10,000 requests/mo
60 req/min
$18/month
- JSON output format — included
- HTTPS encryption — included
- API key authentication — included
- Standard endpoints — included
- Community support — included
- CSV output format — included
- Email support — included
- Usage analytics and alerts — included
- 99.9% uptime SLA — included
- Webhooks — not included
- Priority support — not included
- Custom rate limits — not included
- 99.99% uptime SLA — not included
- Dedicated success manager — not included
- SSO / SAML — not included
- Custom SLA, DPA, and BAA — not included
- Private deployment option — not included
- Volume pricing — not included
Most popular
Pro
250,000 requests/mo
600 req/min
$72/month
- JSON output format — included
- HTTPS encryption — included
- API key authentication — included
- Standard endpoints — included
- Community support — included
- CSV output format — included
- Email support — included
- Usage analytics and alerts — included
- 99.9% uptime SLA — included
- Webhooks — included
- Priority support — included
- Custom rate limits — included
- 99.99% uptime SLA — included
- Dedicated success manager — not included
- SSO / SAML — not included
- Custom SLA, DPA, and BAA — not included
- Private deployment option — not included
- Volume pricing — not included
Enterprise
Unlimited requests
Custom
$252/month
- JSON output format — included
- HTTPS encryption — included
- API key authentication — included
- Standard endpoints — included
- Community support — included
- CSV output format — included
- Email support — included
- Usage analytics and alerts — included
- 99.9% uptime SLA — included
- Webhooks — included
- Priority support — included
- Custom rate limits — included
- 99.99% uptime SLA — included
- Dedicated success manager — included
- SSO / SAML — included
- Custom SLA, DPA, and BAA — included
- Private deployment option — included
- Volume pricing — included
4.8
12 reviews
Grace Mwangi
Head of Product
Held up under real load
We push Breach Check hard during peak and latency has stayed flat. No throttling surprises, no silent degradation — the numbers on the listing matched what we measured.
Mei Chen
Integration Engineer
Good coverage for breach
We checked Breach Check against our own breach reference data before committing. Coverage was better than the incumbent we were paying four times as much for.
Peter Osei
DevOps Lead
Documentation matched reality
Every sample in the Breach Check docs ran unmodified. That sounds like a low bar until you have integrated something where it is not.
Rachel Kimani
Head of Integrations
Now handles account takeover defense too
We adopted Breach Check for password reuse blocking and ended up using it for account takeover defense as well. Same key, no new contract, no second integration.
Chidi Nwosu
Head of Engineering
Support answered properly
Asked Zephiel Labs about an edge case in Breach Check and got an explanation from someone who had clearly read the code, not a link to the FAQ.
James O'Connor
Technical Director
Quietly reliable
Breach Check has not surprised us once in eight months of production traffic. That is the highest compliment I can pay a dependency.
Aisha Suleiman
Digital Lead
One key made the difference
Adding Breach Check took ten minutes because the credential already existed. The vendor onboarding we skipped would have taken longer than the integration.
Anna Kowalski
Senior Developer
Solved Password reuse blocking for us
We brought Breach Check in for Password reuse blocking and it has not needed revisiting since. The response shape matched the documentation on the first call, which is rarer than it should be.