Block the passwords your policy lets through.
For teams that run their own authentication: the raw password never leaves your server, and leaked or org-specific weak passwords are blocked at signup, login and reset. The screening NIST 800-63B specifies and NIS2 audits ask about, with evidence you can hand over.
Free, no card, live in 5 minutes
Become a design partner →See what happens when knownPass is integrated.
A live check against the real API: the password is salted and hashed in your browser, and only a 6-character hash prefix is ever sent, never the password. The full corpus of 20 billion passwords and patterns answers.
Tip: don’t type your actual password into any website you don’t know or yet trust. Only a hash prefix leaves your browser here, but it’s a habit worth keeping.
One endpoint. Zero credentials sent.
Hash the password on your side, send only the first six characters of the salted hash, and compare locally. We never see the password, or even its full hash.
The reference client is a single, self-contained JavaScript component, MIT-licensed. Implement it yourself so you never depend on our codebase.
Read the OpenAPI reference →Twenty billion known passwords and weak patterns.
Every check runs against 20 billion unique passwords and weak patterns: public leaks, malware logs, cracking dictionaries, language wordlists, the short brute-force space, and the org-specific patterns no generic list carries. Continuously expanded.
What we hold: a salted hash of each password and its categories. No emails, no usernames, no source sites. How the dataset is built →
& weak patterns
Every way a password goes bad. Covered.
Not one big breach dump: eight distinct sources of risk, each caught by a different pipeline. The two that no generic list can offer come first.
Tailoredearly access
CompanyName2026 as a password? No longer an option. Tell us your domain and we generate the rest: names, products, places, years.
AI generatedearly access
Let a model guess your passwords from public information about your organization, before an attacker’s model does.
Wordlists
Dictionary words in your language can’t be used as a password, even when they pass the length check.
Bruteforced
Every combination of 1 to 6 standard characters, pre-generated to shut down password spraying.
Malware leaks
Info-stealer logs that already circulate publicly, reduced to the password field at ingestion. Identifiers are discarded.
Website leaks
Hundreds of thousands of site breaches, so a password that already leaked anywhere is blocked here.
Password lists
The wordlists attackers actually load into their cracking rigs.
Common
The most-used and most-leaked passwords from the internet’s best-known lists.
NIST 800-63B asks you to block context-specific words: your company name, product names, the year. Generic breach lists can’t do this. knownPass generates them from your domain. Early access →
Built for teams that run their own auth.
If you use a hosted auth provider, it probably already screens passwords. knownPass is for the self-hosted and regulated cases, where password hashes can’t leave the EU.
Password policy provider
Action on password set
Kratos flow webhook
Password policy
Password policy app
Auth hook
One GET request from any language. Three steps, shown above.
Manifest and dataset files over HTTP, resumable, in every tier including Free. Check inside your own network. Spec.
Order and depth are decided with design partners. Become a design partner →
Compromised-password screening. Blocks passwords from breaches, dictionary words and context-specific words, which is what the guideline asks for.
The Czech and Slovak transpositions are in force. Password hygiene is an expected access-control measure, and a screened password policy is one you can document.
No PII in API calls. EU-hosted. Minimal logging: key ID, timestamp, response code, latency.
Your coding assistant can wire it in.
Everything an AI coding tool needs to integrate knownPass on its own: an OpenAPI 3.1 spec, llms.txt and a typed reference implementation. Hashing happens inside the generated client, so the raw secret never reaches the model, your logs, or our servers.
Point Claude Code, Cursor or Copilot at the docs and ask for the integration: just your API key and a REST call.
One machine-readable source of truth, alongside llms.txt, that generates typed clients for every major stack.
Hashing happens in the generated client. Only a six-character prefix ever leaves your systems, never the password.
Start free. Pay for tailored data and the paperwork auditors ask for.
Today’s prices, in EUR excl. VAT. They may change as early access ends; existing keys get 90 days’ notice. No enterprise tier, no sales call.
- ✓100 requests a day per key
- ✓Community support
- ✓Full base dataset, same as paid tiers
- ✓Bulk download, for self-hosting
No card, no time limit. Over 100 requests a day returns 429.
- ✓Language packs: CZ, SK, DE wordlists
- ✓Dated compliance attestation for auditors
- ✓Email support
- ✓Status page
Fair-use quota, sized for normal signup, login and reset traffic.
- ✓Everything in Team
- ✓Org-specific weak-pattern dataset generated from your domain
- ✓Names, products, places and years your people would pick
Priced per domain. Larger organisations pay more; the rate is agreed during early access.
Four things. In this order.
No platform ambitions. Each item ships when it’s ready and carries a label you can trust: live, early access, in progress or planned.
- Tailored datasets
Org-specific weak patterns generated from your domain. Design partners run it first.
- 02plannedSelf-hosted IdP integrations
Keycloak, Zitadel, Ory, Authentik, Nextcloud, Supabase Auth. Order decided with design partners.
- 03in progressUptime status page
Public status and incident history. Updated by hand today, monitored later.
- 04plannedOpen-sourcing the core
Engine and base dataset under an open license: self-host, audit, no lock-in. Tailored and curated data stay paid. The reference client is MIT today.
Security first. Everything else follows.
One goal: make log-ins measurably harder to compromise. These are the rules the project runs on.
Not everyone can afford premium security. The free cloud tier stays, whatever else we ship.
Never sold, never processed outside this project. Period.
Built and operated under EU privacy rules, by design rather than by checkbox.
We log only what the service needs to work. Nothing more.
Run by KnownPass s.r.o., a Czech company with no investors. The engine and base dataset go open source; tailored and curated data stay paid. Exit guarantee: if the project ever stops, the engine and the full dataset are released under an open license.
Every trade-off resolves toward the safer option, even when it costs us features.
Try it on your project today.
Start free, no card. The integration takes about five minutes. Team and Tailored plans when you need language packs, audit evidence or org-specific data.
No spam · unsubscribe anytime
No. You hash the password on your side and send only a six-character prefix of the salted hash. The raw password and its full hash never leave your infrastructure. The reference client is MIT-licensed, so you can verify exactly what leaves your systems. The full threat model fits on one page.
Usually around 100 ms per request, depending on your region: a few milliseconds of local hashing plus one round-trip. It's a lightweight lookup, not a blocking dependency in your auth flow.
20 billion unique passwords and weak patterns: public breach dumps, malware logs, cracking dictionaries, language wordlists, predictable masks, the 1 to 6 character brute-force space, and (early access) patterns generated from your own domain. Continuously expanded.
A salted hash of each password and the categories it was found in. No email addresses, usernames, user IDs or source sites: those are discarded when raw material is processed, before anything reaches the index. We can’t look a person up in the dataset, and neither could anyone who obtained it. Sources, processing steps and retention are on the data & provenance page.
No, and here’s why. The dataset holds no identifiers, so there is no way to tell which entry is yours. The password you have in mind is shared by everyone else who chose it, and removing it would stop protecting all of them. GDPR recognises this: where a controller can’t identify the person, the access and erasure rights don’t apply to that data (Article 11). If a password of yours is in there, the fix that helps you is to stop using it, everywhere. If you’re a customer and want your email removed, privacy@knownpass.com does that.
Different job. Pwned Passwords is a free list of passwords seen in public breaches, and we recommend it. knownPass adds what a generic list can’t: weak patterns generated from your own domain, language wordlists and masks, a salted hash scheme so lookups can’t be replayed against other services, an authenticated API, and EU hosting for teams whose hashes can’t leave the EU.
Keep it. It’s a good control wherever your login traffic passes through that provider. knownPass is for the cases where it doesn’t: self-hosted identity providers, internal applications, and deployments where password hashes can’t leave the EU. It also adds what no generic list carries: weak patterns generated from your own domain, and language wordlists for the people who actually use your product.
Free: 100 requests a day per API key. Team: a fair-use quota sized for normal signup, login and reset traffic. Over quota you get a 429 with a Retry-After header. No uptime SLA yet: the status page is updated by hand and the infrastructure is monitored but not yet redundant, so design the check to fail open (skip it if we’re unreachable).
Yes. The Free tier is item 01 of the manifest, not a launch offer. Paid tiers cover language packs, audit evidence, org-specific data, and volume above fair use. Existing keys get 90 days’ notice before any change affects them.
Today: anything that can make an HTTP call, through the REST endpoint. Keycloak, Zitadel, Ory, Authentik, Nextcloud and Supabase Auth integrations are planned; design partners decide the order.
Deliver your key and send service notices. No cookies on this site, analytics are cookieless and aggregate-only, and we delete you on request. The whole policy fits on one honest page.