PasswordRadar is a password-screening API. It generates the weak passwords specific to your organisation from its domain (early access) and blocks them together with 20 billion leaked and weak ones, at sign-up, login and reset. The raw password never leaves your server.
Tailored generation, in early access
Free key by email, no card
Run by Šimon Podlesný in Brno through KnownPass s.r.o., a Czech company, and hosted in the EU. Evidence for NIS2 audits.
A live check against the real API, with a public demo key. When you press Check, your browser salts and hashes the password and sends only the first six characters of the hash.
Type a password and press Check, or pick a sample.
The live demo needs JavaScript. The three steps below are the whole integration.
Tip: don’t type a password you really use into a site you don’t trust yet. Only a hash prefix leaves your browser here, but the habit is worth keeping.
SHA-1 of the fixed, public salt plus the password, on your own server.
The first six hex characters pick one of 16,777,216 buckets. They and your API key are all we receive.
Hundreds of full hashes come back with their categories; how many depends on the datasets your key includes. If yours is among them, the password is known: block it.
The reference client is a single, self-contained JavaScript component, licensed Apache-2.0 (repository coming). Or implement the three steps yourself, so you never depend on our code.
import { createHash } from "node:crypto";
// 1. Hash locally. The salt stays exactly as written.
const hash = createHash("sha1")
.update("Salted for knownpass.com: " + password)
.digest("hex");
// 2. Send only the first six characters.
const prefix = hash.slice(0, 6);
const key = process.env.PASSWORDRADAR_API_KEY?.trim();
let known = false;
try {
const res = await fetch(
`https://api.knownpass.com/v1/range/${prefix}`,
{
headers: { Authorization: `Bearer ${key}` },
// 2 s: a new connection takes a few round trips
signal: AbortSignal.timeout(2000),
},
);
if (res.ok) {
// 3. Compare locally.
// A match means the password is known.
const { results } = await res.json();
known = Object.hasOwn(results, hash);
} else if (res.status === 429 || res.status >= 500) {
// over the daily limit, or our fault: fail open
console.warn("password check skipped:", res.status);
} else {
// 400, 401 or 403: your setup, not an outage.
// The flow carries on, but nothing is screened
// until you fix it. 401: check the key.
console.error("password check OFF: HTTP", res.status);
}
} catch (err) {
// a timeout, or the network failing before the answer
// or during it (terminated): fail open. For "fetch
// failed", the cause tells the network from your setup.
const net = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND",
"EAI_AGAIN", "ETIMEDOUT", "EHOSTUNREACH", "ENETUNREACH",
"ENETDOWN", "EHOSTDOWN", "EADDRNOTAVAIL", "ECONNABORTED",
"EPIPE", "UND_ERR_SOCKET", "UND_ERR_CONNECT_TIMEOUT"];
const transient = err.name === "TimeoutError"
|| err.name === "AbortError"
|| err.message === "terminated"
|| (err.message === "fetch failed"
&& net.includes(err.cause?.code));
// log the cause as well; some messages quote the key
const cause = err.cause?.message || err.cause?.code;
let why = cause ? `${err.message}: ${cause}` : err.message;
if (key) why = why.replaceAll(key, "[key]");
if (transient) {
// check again at the next login. (Every check skipped
// behind a proxy? fetch ignores HTTPS_PROXY by default.)
console.warn("password check skipped:", why);
} else {
// won't fix itself: a stray character in the key,
// Node before 18, a TLS failure (a proxy Node doesn't
// trust, or a certificate problem on our side)
console.error("password check OFF:", why);
}
}If the check can’t run, the sample fails open and the flow carries on. A timeout, a network error, 429 or 5xx is logged as a skipped check. A 400, 401 or 403 is logged as an error, and so is any other failure, such as a stray invisible character in the key, a Node version without fetch or a TLS failure: none of them fixes itself, and nothing is screened until it’s fixed. Each log line gives the cause. For 401, check the key.
The product was renamed; its company, KnownPass s.r.o., and the company’s domain were not. That is why the API host and the salt still carry the original name. The salt is part of every hash in the dataset, so it stays exactly as it is, and existing integrations keep working unchanged.
Plain REST from any stack, and the bulk download in every plan, Free included, for checks inside your own network. Your own code needs one REST request; an off-the-shelf identity provider such as Keycloak needs a small extension or script to make it. Ready-made ones are planned, and design partners get the first.
Point Claude Code, Cursor or Copilot at llms.txt or the OpenAPI 3.1 spec and ask for the integration: both tell it to hash on your server and send only the six-character prefix. Review the code it writes as you would any pull request: the raw password should never reach the model, your logs or our servers.
20 billion unique passwords and weak patterns, plus, in early access, the ones your people would pick.
The 20 billion is the total across all categories of the base dataset, generated patterns included, not leaked passwords alone. The dataset keeps growing.
Generated for each organisation
AcmeBrno2026! as a password? No longer an option. Tell us your domain and we generate the rest: names, products, places, years.
Let a model guess your passwords from public information about your organisation, before an attacker’s model does.
Built from dictionaries and rules, not from leaks
Dictionary words can’t be used as a password, even when they pass the length check. Czech, Slovak and German wordlists come with the Team plan.
Predictable shapes, like a word plus a year and a symbol: the masks cracking rigs try first.
Every printable string of 1 to 5 characters (about 7.8 billion), pre-generated: the short passwords a brute-force attack tries first.
Seen in the wild
Passwords from hundreds of thousands of site breaches that already circulate publicly. If a password leaked in one of them, it is blocked here.
Info-stealer logs that already circulate publicly, reduced to the password field at ingestion. Identifiers are discarded.
The password lists attackers actually load into their cracking rigs.
The most-used and most-leaked passwords from the internet’s best-known lists.
What we hold: a salted hash of each password and its categories. No emails, no usernames, no source sites. Which categories are leaked material and which are generated, category by category: data and provenance.
If you use a hosted auth provider, it probably already screens passwords. PasswordRadar is for self-hosted identity, and for regulated teams that must show an auditor how the control works and prefer an EU vendor.
Facts and citations, not legal advice.
Section 3.1.1.2: when a password is set or changed, the verifier SHALL compare it against a blocklist of commonly used, expected or compromised passwords, and the guidance names context-specific words such as the organisation’s or the service’s name. No composition rules, no periodic rotation.
PasswordRadar is that blocklist check, context-specific words included (early access).
Final, August 2025; supersedes Revision 3. NIST SP 800-63B-4 (PDF) (opens in a new tab)
Directive (EU) 2022/2555, Article 21(2)(g), basic cyber hygiene, and (i), access control policies. Screening every new password against a blocklist is a measure you can document.
Context only: neither law nor decree names a product.
No personal data in API calls. EU-hosted. Minimal logging: key ID, timestamp, response code and latency, and web-server access logs kept at most 15 days.
The operator, KnownPass s.r.o., is a Czech company under EU law.
What an auditor or a supplier review asks for, in one place.
Sample attestation, PDF, 2 pages, about 120 KB
Early-access prices in EUR, excl. VAT. They may change as early access ends, and if you already hold a key, you get 90 days’ notice before any change.
No enterprise plan, and you never need a sales call to buy. If a call about your NIS2 evidence or your integration would help, the engineer who built PasswordRadar takes it: ask for a call.
429 with Retry-AfterIn practice: a 500-person organisation that checks every password change and every login usually stays within the 1,000 requests a day included.
€0no card, no time limit
Opens your email app with three short questions. One person answers, usually within a day.
€29per month
Same metering: 1,000 requests a day included, then €0.01 per request.
from €199per month, per domain
Scales with request volume (€0.01 per request over 1,000 a day) and with the size of your tailored and custom datasets: €0.48 per GB per month.
Design partners get tailored datasets first and decide what ships next.
Bulk-download licence: CC BY-NC 4.0, with commercial self-hosting allowed. Full terms.
No platform ambitions. Each item ships when it’s ready and carries a label you can trust: live, early access, in progress or planned.
Organisation-specific weak patterns generated from your domain. Design partners use them first.
Planned next: a preview against your own domain after registration, with domain-ownership verification. The domain is kept for 30 days.
Keycloak, Zitadel, Ory, Authentik, Nextcloud, Supabase Auth. Design partners decide the order.
Public status and incident history. Updated by hand today; automated updates later.
The serving engine under Apache-2.0: self-host it, audit it, no lock-in. The reference client is licensed Apache-2.0 too; its repository is coming.
Something we missed? Ask us directly.
The data flow already protects the password: all we receive is six characters of a salted hash. Hosting location answers a different question: which laws your vendor must obey. PasswordRadar is operated by KnownPass s.r.o., a Czech company under EU law and the GDPR, and the API runs on servers of Hetzner Online GmbH in Germany. The US CLOUD Act reaches providers under US jurisdiction; neither the operator nor the hosting provider is a US company. And what anyone could ask us for is small: key IDs, request times, response codes and latencies, at most 15 days of web-server access logs (IP addresses and hash prefixes), and your account email. Auditors ask about vendor jurisdiction, not only about data flows.
Not for Active Directory itself. There, use what already exists: Microsoft Entra Password Protection and Specops Password Policy both do custom banned-word lists with fuzzy matching. PasswordRadar is for two other jobs: generating the organisation-specific list from your domain instead of typing it in by hand (early access), and screening passwords in non-Microsoft, self-hosted identity providers and custom auth.
Every key includes 1,000 requests a day. Beyond that, each request costs €0.01, pay as you go or from prepaid credit. Without a payment method or credit, requests over 1,000 a day return 429 with a Retry-After header. No uptime SLA yet: the status page is updated by hand and the infrastructure is monitored but not yet redundant, so design the check to fail open (skip it if we’re unreachable).
In your own systems, yes, including paid products. The bulk download of the base dataset is licensed CC BY-NC 4.0 with one added permission, commercial self-hosting: screening the passwords of your own staff and of your own product’s users is allowed. What needs a written exemption from the author, Šimon Podlesný, is selling the screening itself: reselling or redistributing the dataset, running it for other organisations (for example as a managed service provider or an identity-hosting provider), or making it a paid feature of a security product. Ask at hello@passwordradar.eu. Tailored and curated datasets are commercial, for paying customers.
No, and it can’t: the dataset holds no email addresses or usernames, and we never learn whose password you checked. PasswordRadar blocks leaked and guessable passwords when they’re set, changed or used. For alerts about your staff’s leaked credentials, use a breach-monitoring service such as Have I Been Pwned’s domain search or Scattered Secrets alongside it.
No. You hash the password on your side and send only a six-character prefix of the salted hash. The raw password and its full hash never leave your infrastructure. The whole client is three short steps, so you can check exactly what leaves your systems. The reference client, licensed Apache-2.0, will be published too. The full threat model fits on one page.
A salted hash of each password and the categories it was found in. No email addresses, usernames, user IDs or source sites: those are discarded when raw material is processed, before anything reaches the index. We can’t look a person up in the dataset, and neither could anyone who obtained it. Sources, processing steps and retention are on the data and provenance page.
No, and here’s why. The dataset holds no identifiers, so there is no way to tell which entry is yours, and removing a password would stop protecting everyone else who chose it. GDPR recognises this: where a controller can’t identify the person, the access and erasure rights don’t apply to that data (Article 11). Article 11(2) lets a person offer extra information that would identify them in the data, but a password can’t do that: the same password belongs to everyone who chose it. If a password of yours is in there, the fix that helps you is to stop using it, everywhere. If you’re a customer and want your email removed, privacy@passwordradar.eu does that.
From Europe, usually under 100 ms: one round trip on an open connection, plus local hashing that takes well under a millisecond. A new connection adds a few round trips, which from Asia or South America comes close to a second, so give the request 2 seconds. If it fails, your auth flow carries on (fail open).
20 billion unique passwords and weak patterns, in these categories: website leaks, malware leaks, password lists, common passwords, wordlists, masks and patterns, and every printable string of 1 to 5 characters (about 7.8 billion). The generated patterns count towards that total. In early access, patterns generated from your own domain come on top. The dataset keeps growing.
Different job. Pwned Passwords is a free list of passwords seen in public breaches, and we recommend it. PasswordRadar adds what a generic list can’t: weak patterns generated from your own domain (early access), language wordlists and masks, a salted hash scheme so lookups can’t be replayed against other services, an authenticated API, and an EU operator with a dated attestation for your auditors.
Keep it. It’s a good control wherever your login traffic passes through that provider. PasswordRadar is for the cases where it doesn’t: self-hosted identity providers, internal applications, and teams that need an EU vendor and evidence for their auditors. It also adds what no generic list carries: weak patterns generated from your own domain (early access), and language wordlists for the people who actually use your product.
Today, your own code, with one REST request. Off-the-shelf identity providers such as Keycloak need a small extension or script to make that call. Ready-made integrations for Keycloak, Zitadel, Ory, Authentik, Nextcloud and Supabase Auth are planned, and design partners decide the order.
Yes. An always-free plan is one of our principles, not a launch offer. Every key includes 1,000 requests a day, and requests beyond that cost €0.01 on every plan, Free included. Paid plans add language packs, audit evidence and organisation-specific data. If you already hold a key, you get 90 days’ notice before any change affects it.
Deliver your key, send service notices and, occasionally, product updates, with an opt-out in every email. No cookies and no analytics on this site, and we delete your data on request. The whole policy fits on one page.
Self-serve keys aren’t live yet, so a free key takes one email to hello@passwordradar.eu. You’ll usually have it within a day, with no card, and the integration takes about five minutes.
Team and Tailored plans are there when you need language packs, audit evidence or organisation-specific data. Design partners get tailored datasets first.