haveibeenpwned.com
HaveIBeenPwned.com is a trusted security website that shows whether your email address or password has appeared in known stolen data.
What is Have I Been Pwned?
Have I Been Pwned is a free service created by security expert Troy Hunt in December 2013.
The word “pwned” means that someone gained control of an account or exposed its data.
The website collects information from confirmed data breaches, public leaks, and online data dumps.
It then lets people search those records without displaying stolen passwords or other secret data.
As of July 2026, the site lists more than 1,020 breaches involving about 17.8 billion compromised accounts.
These numbers count breach records, so they do not represent 17.8 billion different people.
One person may appear many times because the same email address was used on several websites.
How do you check an email address?
Enter an email address on the main search page and select “Check.”
The result shows each known breach containing that address.
Every breach page may name the affected service, the incident date, the number of accounts, and the exposed data types.
Those data types can include email addresses, names, phone numbers, physical addresses, birth dates, IP addresses, password hashes, or purchase records.
A positive result does not mean someone can still enter your account today.
It means the address appeared in data taken during an earlier security incident.
That history still matters because criminals can combine old names, passwords, and phone numbers with newer information.
Is Have I Been Pwned safe to use?
Searching for an email address is generally safe because an email address is not a secret like a password.
HIBP only tells public users whether the address appears in its database and does not reveal the stolen records themselves.
Some sensitive breaches remain hidden until the user proves control of the email address through the dashboard.
The site’s privacy policy also provides options for removing an address from public searches or excluding it from current and future breach results.
However, people should always check the domain name before entering information because fake security sites can copy the design of trusted services.
The real address is haveibeenpwned.com, uses HTTPS, and does not ask for an account password during an email search.
Can you safely check a password?
The separate Pwned Passwords tool tells you whether a password has appeared in known breach data.
The password is converted into a SHA-1 hash inside your browser before the search happens.
Only the first five characters of that hash are sent to HIBP.
The server returns many possible matches, and your browser completes the comparison locally.
This method, called k-anonymity, means HIBP never receives the full password or its complete hash.
HIBP also states in its frequently asked questions that breached passwords are not stored beside email addresses or other identifying information.
Even so, the best practice is to search an old or suspected password, not a valuable password that you still use.
If a password appears in the results, stop using it everywhere because attackers often test exposed passwords against many services.
What should you do after finding a breach?
First, change the password on the breached account if the account still exists.
Next, replace the same or similar password on every other account where you used it.
Use a long, unique password for each service and let a trusted password manager create and save it.
Turn on two-factor authentication, with a passkey or security key preferred when the service supports one.
Review recovery email addresses, phone numbers, active sessions, connected apps, payment activity, and recent login alerts.
Be extra careful with messages that mention information exposed in the breach because real personal details can make a scam look convincing.
You can also enable free breach notifications after proving that you control the email address.
HIBP will then send an alert if that address appears in a newly added breach.
Does a clean result mean you are safe?
No result means only that HIBP did not find the exact address in the records it currently holds.
The site clearly warns that it contains only a portion of all stolen data because many breaches stay private, remain undiscovered, or never reach HIBP.
Addresses removed through the opt-out process may also no longer appear in public results.
A clean search should therefore be treated as good news, not proof that an account has never been compromised.
Unique passwords, two-factor authentication, software updates, and careful handling of unexpected messages remain necessary.
Can companies use the service?
Organizations can verify control of a domain and search for affected addresses belonging to that domain.
Developers can also use the official REST API to check breach information inside security products and account-protection systems.
The email-address API requires authentication for many searches, while the Pwned Passwords range API remains freely available.
This makes HIBP useful not only as a warning tool, but also as a way to block weak passwords before employees or customers choose them.
Its strongest value is simple: it turns stolen data into an early warning, but users must still take the steps that make the warning useful.