It's intended that you compare the returned full hashes. Otherwise why would the API even return them? This URL is the entire API. Just change the last paramet

It's intended that you compare the returned full hashes. Otherwise why would the API even return them? This URL is the entire API. Just change the last parameter to whatever 5 characters you want: https://api.pwnedpasswords.com/range/aaaaa https://api.pwnedpasswords.com/range/aaaaa Note that the returned hashes omit the first 5 characters, since that would be a waste of resources. You should also note that ALL possible combinations of 5 characters return at least 300 results. So it doesn't make sense to use this API any other way.