Have I Been Pwned
Troy Hunt breach search service covering exposed email addresses, passwords, and domains.
Technical Architecture & Overview
Have I Been Pwned indexes more than a thousand data breaches and lets users search exposure by email address or phone number, check passwords against the breached-password corpus through the k-anonymity API, and subscribe to notifications. Domain monitoring on paid plans alerts when employee addresses appear in new dumps. The service is the de facto reference for breach exposure checks.
Targeted Technical Use Cases
Checking credential exposure for users and domains, and feeding password blocklists from the Pwned Passwords corpus.
Evaluation & Trade-offs
Core Strengths
- +Authoritative and consistently updated breach corpus.
- +Pwned Passwords API is free and privacy-preserving.
- +Notification subscriptions surface new exposure early.
Trade-Offs & Limitations
- -Only includes breaches the curator verified.
- -Sensitive breach data requires paid verification.
Defensive Security Application
Password blocklisting, user exposure checks, and domain-wide leak monitoring.
Frequently Asked Questions
What is Have I Been Pwned?→
Have I Been Pwned indexes more than a thousand data breaches and lets users search exposure by email address or phone number, check passwords against the breached-password corpus through the k-anonymity API, and subscribe to notifications. Domain monitoring on paid plans alerts when employee addresses appear in new dumps. The service is the de facto reference for breach exposure checks.
What is Have I Been Pwned used for?→
Checking credential exposure for users and domains, and feeding password blocklists from the Pwned Passwords corpus.
What are the strengths of Have I Been Pwned?→
- +Authoritative and consistently updated breach corpus.
- +Pwned Passwords API is free and privacy-preserving.
- +Notification subscriptions surface new exposure early.
What are the limitations of Have I Been Pwned?→
- +Only includes breaches the curator verified.
- +Sensitive breach data requires paid verification.
How is Have I Been Pwned used defensively?→
Password blocklisting, user exposure checks, and domain-wide leak monitoring.