Have I Been Pwned

What Is Have I Been Pwned?

You find out a service you use got breached… but you don’t know if your email was in it. Or you’re responsible for a company domain and you want to know whether employees’ addresses are showing up in breach dumps and stealer-log collections. That’s the gap Have I Been Pwned (HIBP) fills: quick, searchable exposure checks, plus optional monitoring so you get alerted when new breach data shows up.

HIBP is built around three core use cases: (1) consumer lookups for a single email address (and free breach notifications), (2) password exposure checks via the “Pwned Passwords” dataset, and (3) business/enterprise workflows via paid subscriptions and APIs for domain monitoring and higher-volume querying. It’s not an “identity theft protection suite” with credit monitoring and insurance. It’s an exposure intelligence database and lookup service geared toward security hygiene.

What makes HIBP distinctive is the way it separates “publicly safe” lookups from sensitive data handling. Sensitive breaches aren’t exposed in public search results; to see them, you have to verify control of the email address via the dashboard. And for password checking, it uses a k‑anonymity range-search approach so clients can check passwords without submitting the full password (or full hash) to the service. (haveibeenpwned.com)

Have I Been Pwned Features and Performance

At the user level, HIBP’s free features are straightforward: you can search an email address and see which breaches it appears in, and you can sign up for breach notifications (“Notify me”) after confirming you control that inbox. Sensitive breaches are handled differently: they’re not publicly searchable, and become visible only after signing in and verifying you can receive email at that address. (haveibeenpwned.com)

For password exposure checks, HIBP runs “Pwned Passwords.” The public-facing point is simple (“is this password known to be exposed?”), but the architecture matters: the password search is designed so the client can hash the password and perform a k‑anonymity range query. In the API reference, HIBP describes a “Pwned Passwords range search (k‑Anonymity)” endpoint that returns hash suffixes and occurrence counts, enabling anonymous checks against the dataset. Cloudflare has also documented and discussed this k‑anonymity approach in the context of Pwned Passwords, including work around padding responses.

On the paid side, HIBP has subscription tiers oriented around organizations that need domain visibility and API throughput. The current plans are organized as Core, Pro, and High RPM (HIBP replaced the older “Pwned” plans with these newer tiers in late March 2026). In the official subscription page, Core is framed as basic domain monitoring + direct email lookups via API (with an API rate limit called out), Pro adds features like k‑anonymity email search, Pwned Passwords support, customer domain monitoring for MSPs, and “stealer log data,” and High RPM focuses on higher-throughput API usage for fast querying (with k‑anonymity email search support and Pwned Passwords support). (haveibeenpwned.com)

Domain workflows are a key dividing line between “toy lookup site” and “operational security tool.” HIBP’s domain search capability requires proving ownership/control of the domain before you can enumerate breached addresses on it. The API documentation describes verification options including DNS record, sending an email to predefined addresses, uploading a file, or adding a meta tag. This is the right constraint: without it, anyone could enumerate the exposure of any company’s employees.

Performance-wise, HIBP is fundamentally an online query service: the “speed” you care about is whether it answers quickly and scales under load. HIBP’s own paid tiers explicitly market API rate limits (e.g., Core plans mention up to 1,000 RPM; Pro plans mention up to 16,000 RPM; High RPM mentions up to 24,000 RPM). (haveibeenpwned.com) For Pwned Passwords specifically, Cloudflare has described extensive caching and implementation work around the API, including the client-side behavior on password searches (hash, truncate prefix, query the range endpoint). Practically, this typically translates into low-latency checks for the common password-range queries, but your real-world outcome still depends on your own network path and how you integrate the API.

Two more practical notes for “identity protection” comparisons:

• HIBP is not a VPN, doesn’t provide encrypted tunnels, and has nothing to do with streaming unblocks.
• HIBP isn’t positioned as a credit-bureau monitoring product. It’s breach exposure lookup + notification + APIs.

Pricing and Plans

Most of HIBP’s consumer-facing functionality is free: you can do personal email address searches and sign up for breach notifications at no cost. (Your site database also lists the pricing model as free; that matches the presence of a free notification and lookup layer.) (haveibeenpwned.com)

Where you pay is when you want business features: domain search at scale, domain monitoring in a managed way, and API access with defined rate limits. HIBP sells subscriptions via plan tiers.

As of the current subscription page, Core plans list annual billing amounts and effective monthly pricing. The page shows (examples): Core 1 at $4.39/month billed as $52.68/year, Core 2 at $21.59/month billed as $259.08/year, Core 3 at $36.99/month billed as $443.88/year, Core 4 at $159/month billed as $1,908/year, and Core 5 at $319/month billed as $3,828/year. (haveibeenpwned.com) The page also states that annual billing can save up to 17% versus monthly billing (where applicable). (haveibeenpwned.com)

Pro plans are positioned for enterprises/MSPs and start much higher. The same page shows Pro 1 at $379/month billed as $4,548/year, with larger tiers stepping upward (Pro 2–Pro 5). It also indicates multi-year billing options (2-year and 3-year) and notes that the table shows an effective monthly price while checkout bills the full term upfront. (haveibeenpwned.com)

High RPM is the throughput-focused API tier, starting at $1,150/month paid annually, with a stated API rate limit up to 24,000 RPM and Pwned Passwords support. (haveibeenpwned.com)

Refunds and cancellations are not “feel-good.” HIBP’s support documentation is explicit: canceling stops renewal, but no refund is issued for unused subscription time if you cancel partway through a pre-paid period. Refunds are described as available only in specific circumstances (for example, a material change request within a defined time window, or domain size exceeding queryable size). (support.haveibeenpwned.com) That’s a real cost consideration if you’re buying an annual term.

Privacy and Security Assessment

Jurisdiction: HIBP is owned and operated by Superlative Enterprises Pty Ltd, based in Queensland, Australia, and its Terms submit disputes to the courts of Queensland and the Commonwealth of Australia. (haveibeenpwned.com) For privacy assessment, that means Australian law (including the Privacy Act framework referenced in the Terms) is the baseline legal environment for data handling and disputes. (haveibeenpwned.com) Whether that’s “good” or “bad” depends on your threat model, but it’s not a zero-jurisdiction offshore setup.

What HIBP stores (and what it doesn’t):

• For breach search: HIBP states that when email addresses from a data breach are loaded, no corresponding passwords are loaded with them. (haveibeenpwned.com)
• For notifications: the FAQ says the notification service does store email addresses (it has to, to know who to notify), along with the date subscribed and a random verification token. (haveibeenpwned.com)
• For password checks: HIBP says passwords are SHA‑1 hashed and not stored next to personally identifiable data such as an email address. (haveibeenpwned.com) The Pwned Passwords API is designed to support k‑anonymity range searches so the service doesn’t need to receive the full password.

Logging/telemetry: HIBP’s FAQ says nothing is explicitly logged by the website, and it mentions Google Analytics, Application Insights performance monitoring, and diagnostic data if an exception occurs. (haveibeenpwned.com) That’s not the same thing as a “no logs” VPN claim (HIBP isn’t a VPN), but it matters if you’re concerned about query metadata.

Open-source posture: Troy Hunt published that he intended to open source the HIBP code base (this is documented on his blog). That statement signals transparency intent, but by itself it’s not proof the full production stack is open-source today, and it’s not a substitute for independent audits.

Known incidents: One relevant, documented incident is a breach entry titled “Troy Hunt’s Mailchimp List Data Breach,” which states that in March 2025, a phishing attack gained access to Troy Hunt’s Mailchimp account and exported a list of newsletter subscribers. This is not “HIBP’s breach database got hacked,” but it is still a security incident involving a related data set (newsletter subscribers) and shows why strong account security (and phishing resistance) matters around any service with a user list.

Net: HIBP’s security model is mostly about minimizing harm from lookups (sensitive breach handling, domain verification, k‑anonymity for passwords). It is not an anonymity tool, and it is not designed to hide your identity—only to help you understand when your identity data has already been exposed elsewhere.

Strengths and Limitations

Strengths

• Free utility that’s actually useful: Email lookups and breach notifications are available without paying, which is exactly what most individuals need.
• Good privacy-by-design choices for passwords: The k‑anonymity range-search model for Pwned Passwords is a sensible approach for exposure checking without sending a raw password to a server.
• Domain verification gates bulk exposure searches: If you want domain-wide results, you must prove ownership/control. That protects people from casual enumeration attacks against organizations.
• Clear subscription segmentation for organizations: Core/Pro/High RPM is a real attempt to separate small-domain needs from MSP and high-throughput API use. (haveibeenpwned.com)

Limitations

• Not full “identity protection”: No credit monitoring, no identity theft insurance, no recovery concierge (HIBP doesn’t claim to be those things). If you need that bundle, you’re looking at a different product category.
• Subscriptions are not consumer-friendly in refunds: Canceling doesn’t refund unused time; refunds are limited to specific criteria. (support.haveibeenpwned.com)
• Notification service necessarily stores your email address: If you want alerts, HIBP keeps the email address and a verification token. That’s reasonable, but it’s not “zero retained data.” (haveibeenpwned.com)
• Jurisdiction may matter for some threat models: The service is operated from Queensland, Australia, and disputes are tied to that jurisdiction. (haveibeenpwned.com)

Who Should Use Have I Been Pwned?

Good fit

1. Individuals who want breach awareness without paying: If you just want to check an address and get future alerts, HIBP’s free search + notification flow is the obvious use case.
2. Security teams that need domain exposure visibility: If you manage an org domain and want to know when employees’ addresses show up in breach data, the domain verification + monitoring model is exactly what HIBP subscriptions are designed for.
3. Developers and services implementing password exposure checks: If you’re integrating “is this password already burned?” into sign-up/reset flows, the Pwned Passwords API is designed for that workflow and supports k‑anonymity range searches.

Not a good fit

1. People shopping for a VPN or anonymity tool: HIBP won’t hide your IP, encrypt your traffic, or unblock streaming. Wrong category.
2. Users who refuse any retained identifier for notifications: If you can’t accept your email being stored for alerting, don’t use the notification feature (use one-off searches instead). (haveibeenpwned.com)
3. Consumers who want “identity theft protection” as a managed service: HIBP tells you about exposure; it doesn’t do the downstream remediation work for you.