Data breaches happen all the time, and there’s a good chance at least one of your email addresses has already been caught up in one. The question is which, and what was exposed.
Have I Been Pwned, created by security researcher Troy Hunt, answers that in seconds. It’s free and doesn’t need an account.
What is Have I Been Pwned?
Have I Been Pwned (HIBP) is a free service that searches billions of records from known data breaches. Enter an email address to see which breaches it appears in and what was exposed (passwords, phone numbers, addresses and so on). Its Pwned Passwords feature checks whether a password has appeared in a breach without ever sending the full password.
Key features
Breach search
Enter your email to see every known breach it appears in and exactly which kinds of data leaked.
Free breach alerts
Sign up for ‘Notify me’ and you’ll get an email if your address shows up in a future breach.
Pwned Passwords
Check whether a password has leaked. A privacy technique called k-anonymity means only part of the password’s hash is ever sent.
How to get started with Have I Been Pwned
- Go to haveibeenpwned.com.
- Enter your email address and click Check.
- Review each breach listed and note what data was exposed.
- Sign up for Notify me, then change affected passwords and turn on 2FA.
Tips to get more out of it
- Check every email address you’ve ever used, including old ones.
- If a breach included passwords, change that password everywhere you reused it.
- A password manager such as Bitwarden makes switching to unique passwords easy.
Is it really free?
Free for individuals, including searching and breach alerts. Paid API plans are for developers and businesses.
Pros and cons
| 👍 Pros | 👎 Cons |
|---|---|
| Instant answers with no account | Only covers breaches it knows about |
| Free breach alerts | Can’t remove your data from a breach |
| Run by a respected security researcher | Some breaches are flagged as sensitive and hidden from public search |
Who is it for?
Best for: Everyone. Seriously, check today..
Works on: Any browser.
Sign-up: Not required (optional for alerts).
Have I Been Pwned alternatives
- Mozilla Monitor: breach alerts from the makers of Firefox.
- Google Password Checkup: checks passwords saved in Chrome or your Google account.
- Your password manager’s reports: Bitwarden Premium and others flag exposed passwords.
FAQ
Is it safe to type my email into HIBP?
Yes. It’s a long-running, widely trusted service, and searching only tells you about breaches. It doesn’t sign you up for anything.
I’ve been pwned. Am I hacked?
Not necessarily. It means your data leaked from a service. Change the affected passwords and turn on 2FA to stay ahead of attackers.
The verdict
It takes ten seconds and could save you a lot of trouble. Check your addresses, sign up for alerts, and fix any reused passwords.
👉 Try it: haveibeenpwned.com
Part of my series on the best free online tools. Pricing and features were checked at the time of writing and can change, so check the tool’s own site for the latest.
