Have I Been Pwned

1 review

Have I Been Pwned (HIBP) is a data breach search and notification service that enables organisations to determine whether their corporate email domains or specific addresses have been exposed in known data breaches. It aggregates tens of billions of breached records, including stealer logs and data fed directly by law enforcement agencies, including the FBI, NCA, and Europol, and provides programmatic access via a REST API and MCP client for LLM integrations. The paid API supports automated domain monitoring, with plans ranging from small-scale deployments to enterprise and MSP configurations supporting enterprise-grade volumes. Both email search and the separate Pwned Passwords API operate on a privacy-first k-anonymity model, ensuring neither the queried address nor the credential is transmitted in a way that exposes it. HIBP is used by security teams, identity providers, MSSPs, and developers to detect credential exposure and trigger remediation workflows such as forced password resets. Dozens of national government CERT teams and cybersecurity agencies worldwide independently recommend the service to their citizens and organisations as a trusted resource following data breach incidents.