About Have I Been Pwned
Have I Been Pwned is a service that checks whether an email address or password has appeared in a known data breach. It is used by individuals, security teams, developers and IT service providers.
What it does
Visitors enter an email address to see which known breaches include it. A password search checks passwords against breached data, and a notification service alerts people when their address appears in a new breach. Security teams and developers can use the API to monitor domains and build checks into their own tools.
Key features
- Check an email address against known breaches
- Search passwords against breached data
- Get alerts when new breaches include your email
- Monitor domains through the API
- Connect AI tools through an MCP server
Who it's for
Anyone who wants to know whether their accounts may have been exposed is the main audience. Security staff who need to check exposure across a whole domain, and developers who want breach checks in their own products, also use the service.
Pricing and good to know
The email search is free to use, and the site has a pricing page for other options. The database lists more than 17 billion breached accounts. A match means the address appeared in a past breach, so it is a prompt to act rather than proof of a new compromise. Change passwords on affected accounts and turn on two-factor authentication where it is available.
Highlights
- Check an email address against known breaches
- Search passwords against breached data
- Get alerts when new breaches include your email
- Monitor domains through the API
- Connect AI tools through an MCP server
