Have I Been Pwned

Check accounts and domains against known data breaches through an API.

breachesapi
Websitehaveibeenpwned.com
CategorySecurity
PricingFreemium
Card requiredNo
← ← Back to directoryGo to Have I Been Pwned ↗ ↗

ABOUT

What is Have I Been Pwned?

Have I Been Pwned (HIBP) is a breach notification service that aggregates data from publicly disclosed data breaches and lets users check if their accounts or domains have been compromised. Pwned Passwords provides a k-anonymity API for checking breached passwords without sending the full password hash. The project was created by Troy Hunt and has become an essential tool for security researchers and developers.

BEFORE YOU SIGN UP

What you should know

✓
Essential breach databaseHIBP aggregates breach data from thousands of sources, making it the most comprehensive public resource for checking account compromises.
✓
Pwned Passwords APIThe k-anonymity model allows checking passwords without sending them in full, enabling secure integration into registration flows and password managers.
△
Data recency depends on disclosureHIBP can only include breaches that have been publicly disclosed. Private or undisclosed breaches are not reflected in the database.
✕
Account API requires subscriptionSearching breached email addresses and domains through API v3 requires a subscription key. Pwned Passwords remains free without a subscription key.

COMMUNITY

From the forums

HIBP is universally respected in the security community, with r/netsec consistently praising Troy Hunt's work on transparency and responsible disclosure. The Pwned Passwords API is widely integrated into registration forms and password managers. The main API tradeoff is that account and domain searches require a paid subscription key, while Pwned Passwords remains free and does not require an API key.

— Community sentiment

💬Discuss on Reddit ↗

SEE ALSO · Security

Alternatives to Have I Been Pwned

Aikido Security

Freemium

Secure code, cloud and runtime from one developer-focused platform

Doppler

Freemium

Centralize and sync application secrets across development and production

GitGuardian

Freemium

Detect exposed secrets in source code and guide their remediation.

ABOUT US

Honest, independent, no fluff.

No paid placements. Just a clear look at what this does, what it costs, and what to know before you commit.

Read more→

FAQ

Questions, answered.

How does HIBP get its breach data?＋

Breach data comes from public disclosures, security researcher submissions and direct dumps verified by Troy Hunt. HIBP does not actively hack or purchase data.

Is the HIBP API free to use?＋

Pwned Passwords is free and needs no API key. API v3 searches for breached email addresses or domains require a paid subscription key.

How is Pwned Passwords different from breach lookup?＋

Pwned Passwords is a dedicated database of password hashes (k-anonymity API) used to check if a password has appeared in any breach, independent of email or username lookup.