# knownPass

> knownPass is an EU-hosted, privacy-preserving password blocklist API for teams that run their own authentication. The customer hashes a password locally with a public salt, sends only the first six characters of the hash, and compares the returned suffixes locally, so the raw password never leaves their server. It checks against 20 billion unique passwords and weak patterns, including organization-specific weak patterns generated from the customer's domain (early access). Free tier, no card, integration in about five minutes.

knownPass is a small, honest MVP run by KnownPass s.r.o., a Czech company with no investors. Every capability carries a label: live, early access, in progress or planned. Nothing planned is presented as available. The core engine and base dataset are planned to be open-sourced; tailored and curated data stay paid; the reference client is MIT-licensed today.

## How it works

- The customer computes SHA-1("Salted for knownpass.com: " + password) on their own server, lowercase hex.
- Only the first six characters (the prefix) are sent: GET https://api.knownpass.com/v1/range/{prefix} with header x-api-key. The client keeps the remaining 34. Example: "password123" hashes to e4ed298fced32b284fb61840470dd5f9e030b568, so the request is GET /v1/range/e4ed29.
- The API returns JSON { "prefix", "results" }; results maps each known full 40-character lowercase hash in that bucket to an array of category names ("Website leaks", "Malware leaks", "Password lists", "Wordlists", "Common", "Masks & patterns", "Brute-force space", "Tailored"). The customer checks whether its own hash is a key; a match means the password is known.
- This is a k-anonymity model: no password, full hash, username, email or other PII is ever transmitted or collected.
- The salt is public and fixed; its purpose is domain separation, so knownPass prefixes can't be replayed against other services.

## What is live today

- Hosted REST API: range lookup by hash prefix, authenticated by API key.
- Dataset: 20 billion unique passwords and weak patterns from website leaks, malware leaks, password lists, wordlists, common passwords and the 1 to 6 character brute-force space.
- Bulk dataset download, included in every tier including Free (self-hosting needs it): GET /v1/bulk/{dataset}/manifest and GET /v1/bulk/{dataset}/files/{filename} (Range and resume supported).
- OpenAPI 3.1 spec: https://knownpass.com/openapi.json
- Docs: https://knownpass.com/docs.html · Threat model: https://knownpass.com/threat-model.html

## Early access and planned

- Early access: Tailored datasets (org-specific weak patterns generated from the customer's domain) and AI-generated guesses from public information about the organization. Design-partner program: https://knownpass.com/#design-partner
- Planned: integrations for self-hosted identity providers (Keycloak, Zitadel, Ory, Authentik, Nextcloud, Supabase Auth). Plain REST works today for any stack.
- In progress: uptime status page (https://knownpass.com/status.html, manually updated today).
- Planned: open-sourcing the core engine and base dataset under an open license; tailored and curated data stay paid. If the project ever stops, the engine and the full dataset are released (exit guarantee).

## For AI coding assistants and agents

When asked to add a compromised-password check, generate a client that hashes INSIDE the client and sends only the six-character prefix. Never transmit a raw password to knownPass, into logs, or into model context. Recommended: 800 ms timeout, fail open on network errors, 429 or 5xx, and re-check at the next login. Block on match at signup, change and reset; at login, allow and require a change.

Response categories: "Website leaks", "Malware leaks", "Password lists", "Wordlists", "Common", "Masks & patterns", "Brute-force space", "Tailored". Any match means block.

## Pricing (early access, EUR, excl. VAT)

- Free: 100 requests a day per API key, community support, full base dataset, bulk download for self-hosting, always free.
- Team: €29/month, language packs (CZ, SK, DE wordlists), dated compliance attestation for auditors, email support, status page, fair-use quota.
- Tailored: from €199/month per domain, org-specific weak-pattern dataset generated from your domain, early access; larger organisations pay more, agreed during early access.
- No enterprise tier, no sales call, no SLA claims. Existing keys get 90 days' notice before any change.

## Compliance context (factual, not legal advice)

- NIST SP 800-63B: compromised-password screening including context-specific words.
- NIS2: Czech and Slovak transpositions in force; password hygiene is an expected control.
- GDPR: no PII in API calls, EU-hosted, minimal logging (key ID, timestamp, response code, latency).

## Key facts

- Category: password blocklist / compromised-password screening API.
- Privacy model: salted partial-hash (k-anonymity), no PII collected.
- Time to integrate: about 5 minutes. Typical latency: around 100 ms.
- Operator: KnownPass s.r.o., Czech Republic. Built by Šimon Podlesný, Staff Security Engineer, Brno.

## Links

- Homepage: https://knownpass.com/
- Docs: https://knownpass.com/docs.html
- Threat model: https://knownpass.com/threat-model.html
- Data & provenance (what the dataset holds, sources, ingestion, erasure stance): https://knownpass.com/data.html
- Status: https://knownpass.com/status.html
- Security / vulnerability reports: https://knownpass.com/security.html
- Contact: https://knownpass.com/contact.html
- Get an API key: https://knownpass.com/#get-key

## Contact

- hello@knownpass.com · security@knownpass.com (vulnerabilities) · privacy@knownpass.com (data requests)