Have I Been Pwned
Check whether your email address appeared in a data breach and get alerts
Own Have I Been Pwned? Claim it, free to correct the facts and get the verified badge.
Pricing
Pricing unknown
API
Yes
Company
Have I Been Pwned
Platforms
What is Have I Been Pwned?
Have I Been Pwned (HIBP) is a data breach search and notification service. You enter an email address and it checks it against breach data the service has loaded, which covers more than 1,000 breached websites and over 17 billion pwned accounts. Results show which breaches the address appeared in, plus any paste records from text-sharing sites or public data dumps.
Besides single email searches, HIBP offers domain search for monitoring corporate domains, a Passwords service, a Notify Me alert for future breaches, an API, an MCP server and NIST compliance resources.
The service is used by individuals checking their own exposure and by security teams, developers and MSPs that use the API to monitor domains and get alerted when new breaches are added.
Key features
- Email search across billions of breached records
- Breach history timeline for each email address
- Paste record detection from public data dumps
- Notify Me alerts for future breaches
- Domain search for monitoring corporate domains
- Pwned Passwords service
- API for developers and security teams
- MCP server integration
Use cases
Who it's for
Personal exposure check
Find out which breaches leaked your email address so you know which passwords to change.
Corporate domain monitoring
Security teams monitor company domains and get alerted when employee addresses show up in new breaches.
MSP client protection
Managed service providers track breach exposure across client domains through the API.
Password screening
Developers check passwords against known breached passwords, for example to meet NIST guidance.
Have I Been Pwned pricing
From the vendor's site, checked Nov 13, 2026. Prices change — confirm on their pricing page.
The vendor does not publish plan details.
Pros and cons
Strengths
- Covers 1,051 breached sites and over 17.8 billion accounts
- Single email checks run from the home page without an account
- API and MCP server available for integrations
- Shows paste records as well as breaches
Limitations
- Only finds breaches that have been loaded into HIBP
- Home page includes sponsored ads
Have I Been Pwned FAQ
What does Have I Been Pwned do?
It checks whether an email address appears in known data breaches or paste dumps, and can alert you when it shows up in new ones.
Can businesses monitor their domains?
Yes. HIBP offers domain search and API access for monitoring corporate domains.
Is there an API?
Yes. HIBP provides an API, and it also offers an MCP server.
How large is the database?
The site lists 1,051 pwned websites and more than 17.8 billion pwned accounts.
Used Have I Been Pwned? Rate it
Sign in to rate this tool and share how you use it.
Have I Been Pwned
Pricing unknown