Security and privacy · by Troy Hunt

Have I Been Pwned

A breach lookup service: enter an email address or domain to see which known data breaches exposed it, plus a separate Pwned Passwords service that tells you if a password has appeared in leaks.

It shows how many real-world leaks a single address has been caught in, and the password check works without ever sending the password itself.

LiveAPIDownloadCommercial: conditions

Open haveibeenpwned.com ↗ agent.md

For your project

Official API: Official API · Free tier Breach, paste and stealer log APIs are rate limited by subscription tier (cheapest plan Core 1: 10 requests per minute, $4.39/month billed annually); no rate limit on the Pwned Passwords API
“An HIBP subscription key is required to make an authorised call” haveibeenpwned.com/API/v3
Key: Needed
“The Pwned Passwords API is freely accessible without the need for a subscription and API key.” haveibeenpwned.com/API/v3
Formats: JSON, TEXT
Data download: Yes text
“The Pwned Passwords Downloader is freely available from GitHub and enables the API to be queried for every single hash prefix and the results saved offline.” haveibeenpwned.com/API/v3
License: CC BY 4.0 data returned by the public API (breach data); email search API needs a paid key, Core plans may not be used on behalf of third parties
Commercial use: Commercial use with conditions
“In other words, you're welcome to use the public API to build other services, but you must identify Have I Been Pwned as the source of the data.” haveibeenpwned.com/API/v3
Credit: Credit required
“Clear and visible attribution with a link to haveibeenpwned.com should be present anywhere data from the service is used” haveibeenpwned.com/API/v3
Embedding: Embedding unclear
Using the website: Free

Read on Have I Been Pwned's own pages on Oct 23, 2026 · license or terms · API docs. Check the license page before you ship.

For your agent

A request your code or agent can make (add your key):

https://api.pwnedpasswords.com/range/21BD1

Official REST API v3: email/domain search needs a paid hibp-api-key header (from $4.39/month, 10 RPM on Core 1); /range/{5 SHA-1 chars} on api.pwnedpasswords.com is free, keyless and unlimited; a User-Agent header is required (403 without). No official SDK named in the docs; a free Pwned Passwords downloader is on GitHub. Privacy page: searches are 'not explicitly stored anywhere', web server logs kept up to 31 days.
Credit Have I Been Pwned with a visible link to haveibeenpwned.com wherever its data is shown (CC BY 4.0)
Send a User-Agent header on every request; only send the first 5 SHA-1 characters of a password
Core plans may not be used on behalf of third parties

Paste into your agent: Read https://agentgid.com/resources/have-i-been-pwned/agent.md before using Have I Been Pwned.

What you can build

Block leaked passwords at sign-upA check in your sign-up and password-change forms that rejects passwords already exposed in data breaches, without ever sending the password anywhere.

A sign-up form check that rejects passwords found in Pwned Passwords using the k-anonymity range API
An offline password-audit tool built on the downloaded SHA-1/NTLM hash corpus
A company dashboard that monitors breaches for its own domain via a paid API key

More in Security and privacy

All 5 →

VirusTotal You can see in seconds how many security vendors disagree about the same file, and community comments show how a threat was spotted. LiveAPINon-commercial Privnote A simple way to pass a secret once without it sitting in chat or email history. License unclear file.io It is built around files that do not linger: links expire on their own instead of piling up in cloud storage. ChangedLiveLicense unclear AccountKiller It shows at a glance which services let you leave cleanly and which ones make it nearly impossible. Non-commercial

Something wrong or out of date? Tell us.