Have I Been Pwned and breach checkers
How to find out whether your email address or passwords have appeared in a data breach, what the results mean, and exactly what to do next.
What Have I Been Pwned is
Have I Been Pwned (often shortened to HIBP) is a free website created in 2013 by Australian security researcher Troy Hunt. It collects data from public breaches, such as leaked customer databases from hacked companies, and lets you check whether your email address appears in any of them. It now covers billions of breached accounts across hundreds of incidents.
The service does not show you the leaked password or personal details. It tells you which breaches included your address and what kinds of data were exposed, for example email addresses, passwords, dates of birth or physical addresses. That is enough to decide what to fix.
Several other tools use HIBP data behind the scenes, including Mozilla Monitor and the breach reports built into password managers such as 1Password.
How to check your email
- Go to haveibeenpwned.com (type the address yourself rather than clicking a link in an email).
- Enter your email address and search.
- Read the list of breaches. Each entry shows the date, the company and the data types that leaked.
- Repeat for every email address you use, including old ones.
Sign up for the free Notify me service on the site. You will get an email if your address shows up in a future breach, so you do not have to remember to check.
If you own a domain (for a small business or family), the domain search feature lets you verify ownership and see breached addresses on that domain.
Checking passwords safely
The Pwned Passwords feature lets you check whether a specific password has appeared in breaches. It is designed so that your password never leaves your device in usable form: your device hashes the password and sends only the first five characters of the hash. The service returns every matching hash and your device compares the list locally. This technique is called k-anonymity.
Even so, the simplest approach is to let your password manager do this for you. Apple Passwords, Google Password Manager, Bitwarden, 1Password and others flag compromised passwords in their security reports.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| No breaches found | Your address is not in any breach HIBP has loaded | Good news, but not a guarantee; keep good habits |
| Breach with email only | Expect more spam and phishing aimed at you | Be extra careful with unexpected emails |
| Breach with passwords | Treat that password as public | Change it everywhere you used it |
| Breach with personal details | Name, phone, address or birth date may be used in scams | Watch for targeted scams and consider a credit freeze |
| Paste or dump entries | Data appeared in a text dump posted online | Treat as exposed and follow the steps below |
Being in a breach is extremely common and is not your fault. What matters is closing the doors it opens.
What to do after a hit
- Change the breached password on that site, and on every other site where you reused it. Reuse is what makes credential stuffing work.
- Turn on two-factor authentication or passkeys for the affected account. See two-factor authentication and passkeys.
- Move to a password manager so every account gets its own random password.
- Expect phishing. Attackers often email breach victims pretending to be the hacked company. Go to the company's site directly instead of clicking links.
- If financial or ID data leaked (Social Security number, card numbers), consider a free credit freeze with the three US credit bureaus and watch your statements.
Scammers send fake "your data was found on the dark web" alerts with a link to a paid "removal" service. Real breach checkers do not demand payment to tell you about a breach.
Other breach checkers worth knowing
- Google Password Checkup in Chrome and Android checks saved passwords against known leaks.
- Apple Passwords shows "compromised" warnings for saved passwords.
- Mozilla Monitor offers free breach alerts based on HIBP data.
Read more about how breaches happen in data breaches explained.
