# Have I Been Pwned

A breach lookup service: enter an email address or domain to see which known data breaches exposed it, plus a separate Pwned Passwords service that tells you if a password has appeared in leaks.

- Category: Security and privacy · by Troy Hunt
- Website: https://haveibeenpwned.com/
- Live data: yes
- Checked on the official pages: 2026-10-23

## API

- Official API: yes, docs https://haveibeenpwned.com/API/v3
- Key needed: yes
- Price: Free tier; limits: Breach, paste and stealer log APIs are rate limited by subscription tier (cheapest plan Core 1: 10 requests per minute, $4.39/month billed annually); no rate limit on the Pwned Passwords API
- Base URL: https://haveibeenpwned.com/api/v3
- Formats: json, text

Example request:

```
https://api.pwnedpasswords.com/range/21BD1
```

## Data and license

- Download: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader (text)
- License: CC BY 4.0 (https://haveibeenpwned.com/API/v3#License); covers data returned by the public API (breach data); email search API needs a paid key, Core plans may not be used on behalf of third parties
- Commercial use with conditions
- Credit required
- Embedding unclear
- Quote (api_official): "An HIBP subscription key is required to make an authorised call" (https://haveibeenpwned.com/API/v3)
- Quote (api_key): "The Pwned Passwords API is freely accessible without the need for a subscription and API key." (https://haveibeenpwned.com/API/v3)
- Quote (api_price): "Different API endpoints are available depending on your subscription tier." (https://haveibeenpwned.com/API/v3)
- Quote (limits): "There is no rate limit on the Pwned Passwords API." (https://haveibeenpwned.com/API/v3)
- Quote (license): "This work is licensed under a Creative Commons Attribution 4.0 International License." (https://haveibeenpwned.com/API/v3)
- Quote (commercial): "In other words, you're welcome to use the public API to build other services, but you must identify Have I Been Pwned as the source of the data." (https://haveibeenpwned.com/API/v3)
- Quote (attribution): "Clear and visible attribution with a link to haveibeenpwned.com should be present anywhere data from the service is used" (https://haveibeenpwned.com/API/v3)
- Quote (download): "The Pwned Passwords Downloader is freely available from GitHub and enables the API to be queried for every single hash prefix and the results saved offline." (https://haveibeenpwned.com/API/v3)
- Quote (data_retention): "The data returned by the search result is not explicitly stored anywhere." (https://haveibeenpwned.com/Privacy)
- Quote (data_retention_logs): "web server logs, retained for up to 31 days" (https://haveibeenpwned.com/Privacy)
- Quote (password_privacy): "Instead, your password is hashed locally and only the first 5 characters of the SHA-1 hash are sent to the API." (https://haveibeenpwned.com/Passwords)
- Quote (plan_limit): "Core 1" (https://haveibeenpwned.com/Subscription)

## Rules for an agent

- Official REST API v3: email/domain search needs a paid hibp-api-key header (from $4.39/month, 10 RPM on Core 1); /range/{5 SHA-1 chars} on api.pwnedpasswords.com is free, keyless and unlimited; a User-Agent header is required (403 without). No official SDK named in the docs; a free Pwned Passwords downloader is on GitHub. Privacy page: searches are 'not explicitly stored anywhere', web server logs kept up to 31 days.
- Credit Have I Been Pwned with a visible link to haveibeenpwned.com wherever its data is shown (CC BY 4.0)
- Send a User-Agent header on every request; only send the first 5 SHA-1 characters of a password
- Core plans may not be used on behalf of third parties

## Build ideas on AgentGid

- [Block leaked passwords at sign-up](https://agentgid.com/resources/ideas/block-leaked-passwords/agent.md)

Human page: https://agentgid.com/resources/have-i-been-pwned/
Source: AgentGid (agentgid.com). Facts are quoted from the site's own pages; check the license page before you ship.