Have I Been Pwned
Troy Hunt breach search service covering exposed email addresses, passwords, and domains.
Technical Architecture & Overview
Have I Been Pwned indexes more than a thousand data breaches and lets users search exposure by email address, check passwords against the breached-password corpus through the k-anonymity API, and subscribe to notifications. Domain monitoring is free for domains with up to 10 breached addresses, and paid plans cover larger domains and API email search. Troy Hunt has run the service since 2013.
Targeted Technical Use Cases
Checking credential exposure for users and domains, and feeding password blocklists from the Pwned Passwords corpus.
Evaluation & Trade-offs
Core Strengths
- +Each loaded breach is listed with the personal data it exposed.
- +Pwned Passwords API is free and privacy-preserving.
- +Notification subscriptions surface new exposure early.
Trade-Offs & Limitations
- -Only covers breaches loaded into the service, and some are flagged as unverified.
- -Sensitive breaches are only visible to the verified address owner.
Defensive Security Application
Password blocklisting, user exposure checks, and domain-wide leak monitoring.
Frequently Asked Questions
What is Have I Been Pwned?→
Have I Been Pwned indexes more than a thousand data breaches and lets users search exposure by email address, check passwords against the breached-password corpus through the k-anonymity API, and subscribe to notifications. Domain monitoring is free for domains with up to 10 breached addresses, and paid plans cover larger domains and API email search. Troy Hunt has run the service since 2013.
What is Have I Been Pwned used for?→
Checking credential exposure for users and domains, and feeding password blocklists from the Pwned Passwords corpus.
What are the strengths of Have I Been Pwned?→
- +Each loaded breach is listed with the personal data it exposed.
- +Pwned Passwords API is free and privacy-preserving.
- +Notification subscriptions surface new exposure early.
What are the limitations of Have I Been Pwned?→
- +Only covers breaches loaded into the service, and some are flagged as unverified.
- +Sensitive breaches are only visible to the verified address owner.
How is Have I Been Pwned used defensively?→
Password blocklisting, user exposure checks, and domain-wide leak monitoring.