When a password hash with the same first 5 characters is found in the Pwned Passwordsrepository, the API will respond with an HTTP 200 and include the suffix of everyhash beginning with the specified prefix, followed by a count of how many times it appears inthe data set. The API consumer can then search the results of the response for the presenceof their source hash and if not found, the password does not exist in the data set. A sampleSHA-1 response for the hash prefix "21BD1" would be as follows: