What is Have I Been Pwned?
Have I Been Pwned is a data breach search service created in 2013 by Australian security researcher Troy Hunt. You type in an email address and it tells you which known breaches that address has turned up in, what kind of data leaked (such as passwords, phone numbers or addresses) and when each breach happened. The database covers billions of breached accounts from more than a thousand incidents.
Beyond a one-off search, you can sign up to be emailed when your address appears in a new breach, and domain owners can monitor every address on their domain. The Pwned Passwords service lets you check whether a password has appeared in breach data without sending the password itself, and it is used by many password managers and websites. Businesses and developers can buy an API subscription for automated lookups.
Main Features
- Search any email address against a large breach database
- Details of each breach, including what data was exposed
- Free email alerts when your address appears in a new breach
- Domain monitoring for organisations
- Pwned Passwords check that never sends your full password
- Paid API for businesses and developers
How to Get Started with Have I Been Pwned
- Go to haveibeenpwned.com
- Type your email address into the search box and run the check
- Read the list of breaches and change any reused passwords they affect
- Sign up for notifications so you hear about future breaches
Have I Been Pwned Pricing
Email searches, breach notifications, Pwned Passwords and monitoring of small domains are free. Paid API subscriptions start with the Core 1 plan at about $4.39 a month billed yearly, with larger Core, Pro and High RPM plans for heavy use.
Who Should Use It?
- Anyone who wants to know if their details have leaked
- People cleaning up reused or old passwords
- IT and security teams watching company domains
- Developers adding breach checks to sign-up forms
- Families helping less technical relatives stay safe
Have I Been Pwned Alternatives
- Free Tool Suite: bundle of free everyday web tools
- Regex101: test and debug regular expressions online
- Can I Use: check browser support for web features
Frequently Asked Questions
Is Have I Been Pwned free?
Yes for personal use. Searching your email, getting breach alerts and checking passwords are free. Only the API for automated lookups is paid.
Is it safe to enter my email on Have I Been Pwned?
The site is run by a well-known security researcher and only searches breach data for the address you enter. The password check uses a method that never sends your full password.
What should I do if my email was in a breach?
Change the password for that service and anywhere else you reused it, turn on two-factor login, and consider using a password manager.