How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Should a Password Hash Ever Be Returned in an API Response?

calendar_today September 2, 2026 domain mojoauth

No. Why a hash in an API response is a credential disclosure, what NIST requires of stored passwords, and the three places hashes leak without anyone writing them into a response.

open_in_new Read original post