Have I Been Pwned: Check if your email address has been exposed in a data breach is a free cybersecurity tool created by security researcher Troy Hunt that allows anyone to search whether their email address or phone number has appeared in known data breaches. The service cross-references submitted credentials against a database of tens of billions of compromised records and alerts users when new breaches are discovered, helping individuals and organizations respond quickly to credential exposure.

Have I Been Pwned: Check if your email address has been exposed in a data breach What Is It and How Does It Work?

Have I Been Pwned is a breach-notification and data-breach search service, not a password manager or antivirus program. It works by aggregating publicly disclosed breach data and making it searchable through a simple web interface. When you enter an email address or domain name, the platform checks it against its compiled breach database and returns a clear result: either the address has not been found in any known breach, or it appears in specific incidents with details about the compromised data types.

The service draws from breaches reported by security researchers, law enforcement, and affected organizations themselves. Each breach entry records which data fields were exposed — passwords, email addresses, phone numbers, IP addresses, or other personal information — giving users context about the severity of the exposure. The site has been widely cited in cybersecurity media and recognized as a standard reference for breach checking.

Have I Been Pwned: Check if your email address has been exposed in a data breach Main Features and Capabilities

Have I Been Pwned provides several core features designed for both individual users and enterprise security teams.

  • Breach Search — Enter any email address to instantly check whether it has appeared in a known data breach, with full details on which breach occurred and what data was exposed.
  • Password Inspection — Upload or paste a password hash to verify whether it has been exposed in any breach without uploading the plaintext password itself.
  • Domain Monitoring via API — Register a corporate or organizational domain and receive notifications whenever any address under that domain appears in a new breach.
  • Pastebin Monitoring — Check whether your email address has been posted on Pastebin, which often contains leaked credentials shared after a breach.
  • Notification Service — Subscribe to alerts so you are notified automatically when your email or domain is discovered in a newly published breach.

Have I Been Pwned: Check if your email address has been exposed in a data breach Who Should Use It

Have I Been Pwned serves a broad audience ranging from everyday internet users to professional security teams.

  • Individual users — Anyone who wants to verify whether their personal email address has been compromised and take corrective action such as changing passwords.
  • IT and security teams — Professionals responsible for monitoring organizational domains and responding to breach events across their company.
  • Managed Service Providers — MSPs who manage multiple clients and need an efficient way to check whether client domains have been breached using the available API.
  • Developers — Engineers building security tools or applications that require breach-checking functionality through programmatic API access.

Have I Been Pwned: Check if your email address has been exposed in a data breach How to Start Using It

Have I Been Pwned offers a straightforward starting process with no mandatory account creation for basic breach searches. Visit haveibeenpwned.com and enter the email address you wish to check in the search field on the homepage. The results page displays every breach where that address appears, including the breach name, date of disclosure, and the types of data involved.

For users who want ongoing monitoring, creating a free account enables the notification feature, which emails you when your address is discovered in a new breach. Organizations can register their domain through the Portal interface to activate domain-level monitoring and API-based querying. The public API documentation provides endpoint details and authentication instructions for integrating breach checks into internal workflows. Registration for API access may require a paid subscription; pricing details are available on the site and may change over time, so please refer to the official website for current information.

What Should You Do After Finding Your Email in a Breach

If Have I Been Pwned returns a positive match for your email address, the most important immediate step is to change the password for the affected account, especially if that password is reused on other services. Enable two-factor authentication wherever available, and review any account activity for signs of unauthorized access. If the breached data includes your phone number or physical address, consider placing a fraud alert on your credit accounts. Regularly checking back at haveibeenpwned.com helps ensure you stay informed about later-discovered breaches that may involve credentials you thought were safe.

常见问题

Is Have I Been Pwned free to use?

Yes, the basic breach search feature is completely free for anyone to use without signing up. Optional features such as domain monitoring and API access may require a registered account or paid subscription, depending on current terms.

Does Have I Been Pwned store my search results or personal data?

Have I Been Pwned has stated that it does not store query results or associate search activity with your identity for basic lookups. For the most accurate and up-to-date information on data handling practices, please review the official privacy policy on the website.

How does the Pastebin monitoring feature work?

The Pastebin monitoring feature checks whether your email address has been posted on Pastebin, a web-based paste repository frequently used to share leaked credential dumps. If your address appears, it is flagged alongside the paste details so you can assess potential exposure risk.

Can I check a domain instead of a single email address?

Yes. By registering your domain through the Have I Been Pwned Portal, you can monitor every email address under that domain and receive notifications whenever any address appears in a new breach, making it suitable for organizational security workflows.

Is the Have I Been Pwned API reliable for enterprise use?

The API is designed for developers and security teams to integrate breach-checking into automated workflows and is widely used in the cybersecurity industry. Rate limits, authentication methods, and pricing may vary; consult the official API documentation on haveibeenpwned.com for current specifications and requirements.