---
title: "Get all breached account hashes for a range"
method: GET
path: "/breachedaccount/range/{prefix}"
---

# Get all breached account hashes for a range

`GET /breachedaccount/range/{prefix}`

Available on Pro and High RPM subscriptions. Search breached addresses via k-anonymity by providing the first 6 characters of the SHA-1 hash of a normalised email address. The response contains matching hash suffixes and associated breach names after public filtering. Sensitive and retired breaches are not returned. Per the terms of use, any results that do not match the target address being searched must be discarded immediately and not stored or further processed.

## Path parameters

- `prefix` string, required

## Headers

- `user-agent` string, required

## Response `200`

Hash suffixes and breach names for addresses in the requested range. Sensitive breaches are removed and any suffix with no remaining public breaches is omitted.

- BreachedAccountRangeResult[]
  - `hashSuffix` string, required — The remaining 34 hexadecimal characters of the breached account's SHA-1 hash.
  - `websites` string[], required — The breach names associated with the hashed account suffix after public API filtering. Sensitive breaches are never returned.

## Other responses

- `400` — Bad request — the prefix was not a 6-character hexadecimal string.
- `401` — Unauthorized — the API key provided was not valid
- `403` — Forbidden — no user agent has been specified in the request, or the current subscription does not include access to the breached-account k-anonymity API.
- `404` — Not found — no public breached-account hashes remain for the requested range after filtering.
- `429` — Too many requests — the rate limit has been exceeded
- `503` — Service unavailable — usually returned by Cloudflare if the underlying service is not available

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)