Have I Been Pwned
The free breach lookup: check whether your email or password appeared in a data breach.
About
Have I Been Pwned is a free breach-notification service created by Australian security researcher Troy Hunt and launched on 4 December 2013. It collects and analyzes hundreds of database dumps and pastes containing billions of leaked accounts and lets anyone check whether their email address or password has been compromised, with details of which breach exposed the data and what was taken. Users can sign up for free notifications if their address appears in a future dump, and the Pwned Passwords API lets browsers and password managers warn users against choosing previously breached passwords.
The service is famously a one-man operation: Hunt runs the technical and operational side alone, carefully limiting stored data to emails, phone numbers, and passwords while discarding names, addresses, and bank details. Despite the legal grey area, no breach victim organization has sued in over a decade, and national governments, law enforcement agencies, Mozilla, and 1Password all use the service. Between January and October 2026 alone, 108 breaches covering about 540 million accounts were added, per an independent count of its public breach list.
What it can do
- Free email and domain breach lookup
- Pwned Passwords API with k-anonymity privacy model
- Future-breach email notifications
- Full public breach catalogue with metadata
- Used by Mozilla, 1Password, governments, and law enforcement
- Downloadable password lists in SHA-1 and NTLM formats
Setup
- Visit haveibeenpwned.com and enter an email address; no sign-in or payment needed.
- Review the listed breaches, when each happened, and what data was exposed.
- Use the free Notify Me option for future-breach alerts on each address you use.
- Developers: integrate the free Pwned Passwords API (k-anonymity model) into sign-up and password-change flows.
Prerequisites
None for lookups; API consumers should read the usage guidance for the k-anonymity password endpoint.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (TIER verified, metrics-v1). Evidence: operating continuously since Dec 2013; hundreds of breaches indexed with billions of records; trusted by Mozilla, 1Password, national governments, and law enforcement; Troy Hunt's respected independent track record; free with no upsell gating core lookups. Strengths: the canonical public breach resource, privacy-conscious data handling, free API with k-anonymity. Docked for: (1) one-person operation creates key-person risk, though it has run this way for 13 years; (2) coverage only reflects breaches whose data has been found and loaded, so a clean result is not a guarantee. License: free service (code and API terms per haveibeenpwned.com).
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 10.0/10
- Maintenance · recency, releases, issue load
- 7.0/10
- Openness · license + docs
- 5.0/10
- Manual review · sanity read + red-flag check
- 1.0/10
- · Operating continuously since Dec 2013; hundreds of breaches, billions of records
- · Trusted by Mozilla, 1Password, national governments, law enforcement
- · Free Pwned Passwords API with k-anonymity; privacy-conscious handling
- · One-person operation; coverage only reflects loaded breaches
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.