Credential Check API Know if a login is already compromised, without the password leaving your server.
Your app hashes the exact email and password pair, sends only a short hash prefix and compares the protected matches locally, against billions of breached records.
- Hashed on your server
sha256("[email protected]:password123") → 5baa61e4c9b93f3f0682250b6cf8331b... - Only the prefix is sent
prefix = "5baa6" - Matches compared locally
found: true → force a reset
How it works
Your users stay protected. Their credentials stay private.
Hash the credential pair
Your application receives the login, for example [email protected] with password123, and hashes the pair on your server.
Pseudocode // Hash the credential pair const hash = SHA256(email + ':' + password) // → 5baa61e4c9b93f3f0682250b6cf8331b...Send the prefix only
Take the first 5 or 6 characters of the hash and send only that prefix. Six characters returns fewer results, so responses are faster.
Privacy layer 1: only 5 or 6 characters of the hash are sent, like checking a library card without revealing your name.
Pseudocode const prefix = hash.substring(0, 5) // or 6 for fewer results // → "5baa6" or "5baa61" await fetch('/credential-check/query', { prefix })HMAC protection applied
The API finds every hash with that prefix and scrambles them with HMAC before sending them back.
Privacy layer 2: results are protected with HMAC, so even if intercepted they reveal nothing.
Pseudocode // Server generates an HMAC key results = matchingHashes.map(h => HMAC(h, key)) return { results, key }Check the match locally
Your app applies the same HMAC to its full hash and checks whether it is in the results, entirely on your side.
Pseudocode if (results.includes(HMAC(hash, key))) { // Breach detected } else { // All clear }
Breach detected
Action requiredRespond automatically or trigger it manually:
- Block account access Prevent login until the password is reset
- Force a password reset Require an immediate credential change by email
- Alert the security team Trigger your SIEM or incident response workflow
- Notify the user Send a breach notification with remediation steps
- Log the incident Record the detection in your audit trail
All clear
Safe to proceedThe credentials are not in any known breach:
- Grant access Let the user carry on signing in
- Log the success Record the verification in your audit trail
- Update metrics Track verification stats for security analytics
- Continue the session Proceed with the normal authentication flow
Why this matters
Your users' credentials are never exposed to DarkStrata or anyone else. With two privacy layers, even we can't see what you're checking; only you know if there's a match.
- No credentials leave your server
- Cryptographically impossible to reverse
- GDPR compliant by design
Where it fits
Protect your users across the whole authentication lifecycle.
Sign-in
Verify credentials at login to catch compromised accounts before they can be exploited, and force a reset automatically.
Registration
Stop new users signing up with previously breached credentials, protecting your platform from credential stuffing from day one.
Password reset
Make sure a new password has not already appeared in a data breach before you accept it.
Continuous monitoring
Periodically recheck your user base against newly discovered breaches and tell users when their credentials turn up.
Offline diff files
HMAC-anonymised hash files for offline checking in password vaults, enterprise password managers and bulk credential audits, on the Enterprise plan.
AI agents
Read credential check stats from AI agents through the DarkStrata MCP server.
Official SDKs
Open-source SDKs for seven languages. Each one hashes locally and sends only the prefix, so credential checking is a single call with no cryptography to write.
All SDKs on GitHubInstall
npm install @darkstrata/credential-checkCheck a login
import { DarkStrataCredentialCheck } from '@darkstrata/credential-check';
const client = new DarkStrataCredentialCheck({ apiKey });
const result = await client.check(email, password);
if (result.found) {
// force a password reset
}Compared with building it yourself
Enterprise-grade breach protection without compromising your users' privacy or running your own breach database.
| Feature | DarkStrata | In-house database |
|---|---|---|
| Privacy protection | k-anonymity plus HMACTwo cryptographic privacy layers | You hold the credentialsFull exposure if your store leaks |
| What leaves your server | A 5 or 6-character prefix1 in 1M (5 characters) or 1 in 16M (6 characters) anonymity set | Nothing, but the breach data lives with youStorage and security are your problem |
| Breach coverage | Billions of recordsConstantly updated | Manual collectionExpensive to maintain |
| Maintenance | NoneFully managed service | HighStorage, updates, security |
| Client libraries | Seven official SDKsNode.js, Python, Rust, Go, C#, Java, PHP | NoneBuild everything yourself |
| Compliance | GDPR readyNo PII transmitted | ComplexThe full data protection burden |
Free to start
Credential Check is on every DarkStrata account, including the free tier. No card and no sales call: create an account, mint a key scoped to credential_check:read and you can be checking passwords the same afternoon.
- Results are cacheable, so repeated passwords don't each cost a check.
- Over quota, the API returns 429 so your sign-in flow carries on unscreened rather than locking anybody out.
- Free keys are licensed for checking sign-ins on sites you operate.
- Paid plans add breach and infostealer monitoring for your own domains.
Building Credential Check into a product you sell?
Software vendors, agencies and platforms embed Credential Check under a partner licence: one agreement, unlimited checks across every site you deploy to, and no free-tier restriction on your customers.
Talk to us about a partner licenceBuild with it
- API docsEndpoints, authentication and response formats(opens in a new tab)
- LaravelDeny compromised logins and reject breached passwords in Laravel
- UmbracoBlock compromised passwords for Umbraco members and backoffice users
- SplunkBring DarkStrata alerts and indicators into Splunk
- MCP serverDrive DarkStrata from AI agents
- SDK repoEvery SDK and integration on GitHub(opens in a new tab)
Start building with DarkStrata's APIs
Get your free API key and start checking credentials in minutes.