---
title: "Pwned Passwords range search (k-Anonymity)"
method: GET
path: "/range/{prefix}"
---

# Pwned Passwords range search (k-Anonymity)

`GET /range/{prefix}`

Free Pwned Passwords range search using k-anonymity. This endpoint does not require authentication and is not rate limited, but it still requires a user-agent header. Provide the first 5 characters of either a SHA-1 or NTLM hash to receive matching suffixes and prevalence counts.

## Path parameters

- `prefix` string, required

## Query parameters

- `mode` 'ntlm'

## Headers

- `user-agent` string, required
- `Add-Padding` boolean

## Response `200`

Hash suffixes and prevalence counts. Each line contains a hash suffix followed by a colon and the count of how many times the password appears in the data set. Padded entries (when Add-Padding is used) always have a count of 0 and should be discarded.

## Other responses

- `403` — Forbidden — missing or invalid user agent

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)