01 · Product name
Have I Been Pwned
Check whether an email address appears in known data breaches.
Published by Troy Hunt.
In short
Have I Been Pwned, run by Troy Hunt, tells you if an email address shows up in breaches it has loaded. The website lookup is free. The API that checks addresses in bulk is a paid subscription. A separate Pwned Passwords service lets you test a password with k-anonymity, without sending the whole password.
Product pricing strategy
02
Free and paid
Have I Been Pwned is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
The website search is free. The API for automated email lookups is paid. Pwned Passwords range lookups are free. Domain search is free for verified domain owners.
Utility and features
03
Have I Been Pwned is the breach lookup that does not require you to trust a random paste site. You enter an email. It returns the breach names it knows, with dates and descriptions, or it returns nothing. Nothing means “not in this corpus,” not “this person was never exposed.”
- Address search. The public site answers a single email. Breaches are named and described. Paste listings, when present, are a separate result from breach listings.
- API and domain search. Bulk or automated email checks need the paid API key. Domain search is for verified owners of that domain, not for open-ended fishing.
- Passwords. Pwned Passwords uses a hash prefix so the full password is not submitted. Use that API for password hygiene. Do not paste live passwords into random websites.
Domain search is available to people who can prove they control the domain, which makes it a defensive tool for security teams. The notification service watches an address going forward. Automated address lookups use the paid API. Password checking is a different product: the range API is free and is the one to integrate if you want to warn users about exposed passwords without building a breach archive.
- 1
Search an email you are responsible for — yours, a consenting subject, or a domain you administer.
- 2
Read the breach description and date. A hit is exposure of that address in that corpus, not a full account takeover by itself.
- 3
If you own the domain, verify it and review the domain report instead of querying employee mail one by one on the public form.
- 4
For passwords, use the k-anonymity API or the official password page. Do not send a raw password to an unofficial clone.
Caveats
04
The public website lookup is free. Bulk and API access are paid. HIBP only knows breaches it has loaded, so a miss is ‘not in this corpus,’ not ‘this address was never exposed.’
Breach data is historical. It does not say whether the password was changed, whether the account still exists, or whether the person still uses that mailbox. Pwned Passwords is a different service: you test a password with a hash prefix, and you do not send the whole password. Do not turn a breach row into an attempt to log in.
Screenshots
05
Potential use cases
06
- Someone asks whether their email is in a known breach. You search the free website. The output is the breach names HIBP has loaded for that address, or a clear miss. Pivot a hit to the breach description on the same site so you can say what kind of data was exposed, then to Holehe if the question becomes which services know the address. A row is not proof of how the password is used now, and it is not a reason to try the password anywhere.
- You administer a domain and need to see which mailboxes show up. The website is the wrong tool for a long list. The domain search and the API are the paid path Troy Hunt sells for that volume. Output is addresses and breach names you are allowed to look up. Pivot noisy addresses to Intelligence X only if your question is the archive, not the HIBP corpus. Do not paste a password into the breach search. Pwned Passwords is the separate k-anonymity check, and it is for a password you already have, not for guessing one.
- A shared mailbox appears in a breach notice. Search that address, record the breach names and dates, and tell the owner to rotate credentials through the account’s real provider. The listing does not describe how to reuse a leaked password. The useful output is the breach list and the date you checked.
Hard cases
The case where the first result is easy to over-read.
The address is clean and the password is not the question
HIBP returns no breaches for the email, and someone treats that as ‘the account is safe.’ It is only a miss in this corpus. If the worry is a password they already know, use Pwned Passwords, not the email search. If the worry is which sites have the address, open Holehe. Write the negative HIBP result down with the date, and do not let it cancel a second source.
Questions
Is Have I Been Pwned free?
The website search is free. The API for automated email lookups is paid. Pwned Passwords range lookups are free. Domain search is free for verified domain owners.
Does a clear result mean the email was never breached?
No. It means the address was not in the breaches Have I Been Pwned had loaded at that moment. Other incidents exist, and new ones are added over time.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Have I Been Pwned
https://haveibeenpwned.com/Documentation
Have I Been Pwned API v3
https://haveibeenpwned.com/API/V3Documentation
Have I Been Pwned FAQs
https://haveibeenpwned.com/FAQs