Have I Been Pwned
Check accounts and domains against known data breaches through an API.
ABOUT
What is Have I Been Pwned?
Have I Been Pwned (HIBP) is a breach notification service that aggregates data from publicly disclosed data breaches and lets users check if their accounts or domains have been compromised. The Pwned Passwords service provides a searchable database of over 800 million real-world passwords for credential hygiene. The project was created by Troy Hunt and has become an essential tool for security researchers and developers.
BEFORE YOU SIGN UP
What you should know
COMMUNITY
From the forums
HIBP is universally respected in the security community, with r/netsec consistently praising Troy Hunt's work on transparency and responsible disclosure. The Pwned Passwords API is widely integrated into registration forms and password managers. The main criticism is that the API rate limits on the free tier can be restrictive for large-scale integrations, though the paid subscription model addresses this for commercial use.
— Community sentiment · Reddit
SEE ALSO · Security
Alternatives to Have I Been Pwned
ABOUT US
Honest, independent, no fluff.
No paid placements. Just a clear look at what this does, what it costs, and what to know before you commit.
FAQ
Questions, answered.
How does HIBP get its breach data?＋
Breach data comes from public disclosures, security researcher submissions and direct dumps verified by Troy Hunt. HIBP does not actively hack or purchase data.
Is the HIBP API free to use?＋
The API is free for non-commercial use with rate limits. Paid subscription plans provide higher rate limits for commercial integrations.
How is Pwned Passwords different from breach lookup?＋
Pwned Passwords is a dedicated database of password hashes (k-anonymity API) used to check if a password has appeared in any breach, independent of email or username lookup.