Have I Been Pwned
haveibeenpwned.com
Have I Been Pwned: Check if your email address has been exposed in a data breach
Have I Been Pwned allows you to check whether your email address has been exposed in a data breach.
FAQs
Find answers to frequently asked questions about Have I Been Pwned, including data sources, breach handling, notification services, and account security.
Notify Me
Get notified if your email address appears in a future data breach. Have I Been Pwned will alert you when we find your email address is exposed.
Passwords
Pwned Passwords is a huge corpus of previously breached passwords made freely available to help services block them from being used again.
Who's Been Pwned
Every breached website added to Have I Been Pwned appears here on the Who’s Been Pwned page. As of today, there are 929 breached sites listed.
Wikipedia
en.wikipedia.org › wiki › Have_I_Been_Pwned
Have I Been Pwned? - Wikipedia
1 month ago - Have I Been Pwned? (HIBP) is a website that allows Internet users to check whether their personal data has been compromised by data breaches. The site has been widely touted as a valuable resource for Internet users wishing to protect their own security and privacy.
Videos
04:26
This FREE Cyber Security Service Is A Total MUST HAVE - ...
12:17
How To Use Have I Been Pwned to See If Your Data Was Compromised ...
02:03
Have I been pwned? 😱 - YouTube
03:50
Have I Been Pwned Data Breach Checker Honest Review | haveibee...
05:32
Have I been pwned?! Check which websites have leaked your accounts ...
Secure Your Online Identity Change Your Gmail Password ...
Reddit
reddit.com › r/techsupport › is ‘haveibeenpwned’ safe?
r/techsupport on Reddit: Is ‘haveibeenpwned’ safe?
February 14, 2024 -
Im really paranoid about data breaches and i just really wanna know
Top answer 1 of 16
223
It's safe -- You can even put your password in there to check. The way it works is pretty clever: Your password gets hashed, and the first 5 characters of that hash are sent to the server Server responds with all known passwords that have a hash that share the same first 5 characters The password you entered is compared to the list of passwords returned (this step is done entirely in your browser) https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity
2 of 16
104
Yes it's safe. Your data can't be breached by just entering an email address anyway.
Trustpilot
ca.trustpilot.com › home › electronics & technology › internet & software › software company › have i been pwned reviews
Have I Been Pwned Reviews | Read Customer Service Reviews of haveibeenpwned.com
4 days ago - Have I Been Pwned (HIBP) is an online service that allows individuals and organisations to check whether their personal data has been compromised in known data breaches.
Address 4217, Surfers Paradise, AU
Password Manager
passwordmanager.com › home › have i been pwned?
Have I Been Pwned? | Password Manager
May 5, 2023 - Find out if your email or phone has been pwned, which means being involved in a data breach.
Reddit
reddit.com › r/privacy › how safe is haveibeenpwned.com?
r/privacy on Reddit: How safe is haveibeenpwned.com?
April 7, 2023 -
Is it safe to use haveibeenpwned.com? Do they store the e-mail/phone number you search? Those who understand back-end processing, please enlighten me on the site.
Top answer 1 of 6
26
The site is run by a white hat hacker, Troy Hunt. It allows you to search any email address, which is already in the database of hacked accounts. Nothing is stored, and even if it was, nothing particularly useful would come of it. The only exception is for sensitive breaches, like Ashley Madison for example. In that case, you need to verify the email address is yours before information is returned regarding it. I can't quite remember the details why. Signing up for breach alerts is another option, which many other services already offer. But that stuff is made very clear. It's a bit of a paradox, that a site like that looks much scarier than the initial sites that breached to the data to begin with. LinkedIn looks safer than HIBP. Looks can be deceiving.
2 of 6
15
Troy Hunt is a renowned security expert, working for Microsoft. He did consider to give someone else the responsibility for this site some years back. But he got cold feet when realising those willing to take that task didn't necessarily have the purest intentions with the site data, and it would not be in the best interest of its users. Not too long after, he started selling the API access to sites wanting to query if usernames, e-mail addresses, etc was comprised. I believe this service can also do API callbacks when their users is caught in a compromise. This service offering mostly funds HIBP, in addition to other donations. I have several of my own domains listed there, and occasionally I do get some warnings when new breaches are registered. That often explains quite well when an e-mail address is getting a lot more unexpected spam or phishing attempts.
Reddit
reddit.com › r/passwords › does it really make sense to use have i been pwned?
r/Passwords on Reddit: Does it really make sense to use Have I Been Pwned?
March 29, 2025 -
I’ve been wondering how effective HIBP actually is. When a site gets breached, the leaked data is often sold or circulated in private before it’s added to public forums on dark web and then to breach databases like HIBP. By the time my password shows up there, it might be too late to do anything useful.
Also my email - unless it is unique, random address, it is visible in public web anyway. So why should I look for it on dark web?
Top answer 1 of 6
8
Your the only one that will have your own unique email - otherwise your mail would never arrive. When YOUR user name password combo is breached it's better to know than to not, so you can decide what's best for you. Better still - use unique passwords over every website for prevention.
2 of 6
4
Passwords are not always compromised through websites. They can be stolen by info-stealer malware on your own computer, which you may not even notice. Due to the large volume of stolen data, these databases are placed for sale to scammers. Unless you're a very specific target (like a public figure) you have chance to find your password earlier.
Consumer Reports
consumerreports.org › electronics & computers › how to use 'have i been pwned' to see if your data was compromised
How to Use 'Have I Been Pwned' to See If Your Data Was Compromised via @ConsumerReports
October 24, 2022 - Search for Your Information The primary function of Have I Been Pwned is to tell you whether your information has been compromised. Enter your email address or phone number and you’ll get a list of data breaches tied to those details.
Troy Hunt
troyhunt.com › 2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned
Troy Hunt: 2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned
November 14, 2025 - Edit: Just to be crystal clear about the origin of the data and the role of Synthient (who you’ll read about in the next paragraph): this data came from numerous locations where cybercriminals had published it. Synthient (run by Ben during his final year of college) indexed that data and provided it to Have I Been Pwned solely for the purpose of notifying victims.
Reddit
reddit.com › r/privacy › turns out i have been pwned, what now?
r/privacy on Reddit: Turns out I HAVE been pwned, what now?
November 21, 2024 -
I usually check haveibeenpwned.com every year or so and it's always come back negative for any breaches, until now. Turns out my info has been in 3 breaches in just the last 6 months, so what would be the best course of action here?
Top answer 1 of 21
129
Use a dedicated pw manager, 1 random unique pw per service. Bitwarden, keepass, protonpass etc. Activate totp 2fa whenever possible. Ente auth, 2fas, keepass etc. Use a dedicated email alias service, 1 unique address per service. Simplelogin, addy.io, duck.com, firefox relay etc. Basically to clean up your digital opsec.
2 of 21
61
A few things to consider: - Change your email address for everything. Dedicated emails for different services, for example Gaming, Shopping, Personal, Work, Throwaway. - Change your passwords. Use a password manager like Bitwarden and generate long complex passwords or passphrases. NEVER save passwords in a browser. - Enable 2FA on everything possible. Yes, I know this is obvious but you would be really surprised to know that many people stil don't use 2FA in 2024. This is an obvious recommendation, but stop using the same email address for everything. My friend used to use 1 email address for everything (banking, personal, work, gaming, shopping and random sites). He almost lost everything because of this. Don't be my friend.
1Password
1password.com › haveibeenpwned
Have I Been Pwned | 1Password
Discovered your data was breached? Learn about Have I Been Pwned and how 1Password can secure your online accounts and sensitive information.
ZDNET
zdnet.com › home › tech › security
Your logins could be among 180M just added to Have I ...
November 5, 2025 - HIBP is a free service that can give you an overview of whether or not it is likely your online accounts have been "pwned," or compromised, in a data breach. Once you've submitted your email address for review, you are told how many data breaches, if any, your information has been leaked in.
DMARC Report
dmarcreport.com › blog › have-i-been-pwned-check-data-breaches-simple-way
Have I Been Pwned? A Simple Way to Check for Data Breaches – DMARC Report
September 17, 2025 - If your email appears on “Have I Been Pwned,” immediately change your password for that account and any other accounts using the same password. It’s crucial to enable two-factor authentication (2FA) if available, as it adds an extra security layer against unauthorized access.
Google
docs.cloud.google.com › security › google security operations › have i been pwned
Have I Been Pwned | Google Security Operations | Google Cloud Documentation
Check if you have an account that has been compromised in a data breach.
Troy Hunt
troyhunt.com
Troy Hunt: Troy Hunt
Twelve years (and one day) since launching Have I Been Pwned, it's now a service that Charlotte and I live and breathe every day. From the first thing every morning to the last thing each day, from holidays to birthdays, in sickness and in heal... wait a minute - did we marry each other or a data breach service?!
Troy Hunt
troyhunt.com › why-does-have-i-been-pwned-contain-fake-email-addresses
Troy Hunt: Why Does Have I Been Pwned Contain "Fake" Email Addresses?
2 weeks ago - The way this normally works (and this is what we do with HIBP when you sign up for the free notification service) is you enter the email address, the system generates a random token, and then the two are saved together in the database. A link with the token is then emailed to the address and used to verify the user if they then follow that link. And if they don't follow that link? We delete the email address if it hasn't been verified within a few days, but evidently, Adobe doesn't.
Vertex Cyber Security
vertexcybersecurity.com.au › should-i-use-have-i-been-pwned-hibps
Should I use Have I been pwned (HIBP) ? - Vertex Cyber Security
August 15, 2024 - So, you might have heard of a website “Have I been pwned” (HIBP) which contains a list of hacked user emails and passwords that you can check to see if your email or password has been hacked.
TeamPassword
teampassword.com › blog › have-i-been-pwnd-what-to-do-when-it-happens
TeamPassword | What to Do if You've Been Pwned: A Complete Guide
Have i been pwned? is an invaluable tool to see whether your passwords have been compromised. Learn what to do if you are a victim of a leak.
Have I Been Pwned
haveibeenpwned.com › NotifyMe
Have I Been Pwned: Get Breach Notifications
Get notified if your email address appears in a future data breach. Have I Been Pwned will alert you when we find your email address is exposed.
Reddit
reddit.com › r/technews › have i been pwned adds 183 million more emails from major new breach
r/technews on Reddit: Have I Been Pwned adds 183 million more emails from major new breach
October 25, 2025 - Why won't they tell you what the password was that was breached? My info has been breached so many times the fact an email is out there in the wild isn't concerning, but it would be hugely helpful to know the password paired with it and whether it is compromised or not. But Have I Been Pwned and the paid