Have I Been Pwned (HIBP) is a free website where you type in an email address and see which known data breaches that address appeared in. It is run by one person, security researcher Troy Hunt, and as of October 2026 it indexes 1,047 breached websites and about 17.8 billion breached accounts.
Most people land on it after a scary email, a reused password, or a friend's "go check this." Below: what the site actually does, why it is safe to use, how to read the result, what it cannot see, and what to do in the first hour if your address shows up.
- Have I Been Pwned checks whether your email address appears in a known data breach. It does not tell you whether someone is in your account right now.
- Entering your email is low-risk: the site says searches are not logged and no passwords are stored next to emails. Type the address yourself, never follow a link.
- "Pwned" means your data was in a leak somewhere. The danger depends on what was exposed and on whether you reused that password.
- "No breaches found" is not a guarantee: some breaches are never discovered, and sensitive ones stay hidden until you verify the address.
- If you are pwned: secure your email first, change reused passwords, turn on two-factor authentication, and ignore messages that try to rush you.
What is Have I Been Pwned?
Have I Been Pwned is a breach-lookup service. It collects data dumps from hacked websites, loads the email addresses (and other fields) into a searchable index, and lets anyone check their own address for free.
Troy Hunt launched it on 4 December 2013, shortly after the Adobe breach exposed 153 million accounts. The first version indexed just five breaches: Adobe, Stratfor, Gawker, Yahoo! Voices and Sony Pictures. Today the index covers more than a thousand (Wikipedia, HIBP homepage).
The name is hacker slang. To "pwn" something is to compromise or take control of it, from gaming culture where "owned" meant "beaten." The logo even contains ';--, a classic SQL injection string.
HIBP is owned and run by Hunt's own company, not by a data broker or a security vendor. In 2019 he tried to sell it, then announced in 2020 that it would stay independent. Vendors such as password managers pay to integrate its data, and the site shows sponsor links for one of them.
Is Have I Been Pwned safe and legit?
Yes. It has run for over a decade, is recommended by Consumer Reports, and its data is built into products you may already use. The reasonable worry is "am I handing my email to a stranger?" Here is what the site's own FAQ says on that:
- Searches are not logged. The FAQ says they run over an encrypted connection and that the site is not harvesting addresses. Even if someone could see the traffic, an email address alone is not enough to get into an account.
- No passwords sit next to emails. When a breach is loaded, the passwords are not loaded with it. There is also no way to have your exposed password emailed to you, on purpose.
- There is no public list of everyone's email. You can only ask about one address at a time.
One honest caveat from the same FAQ: you cannot prove a website is not logging you. If that bothers you, search an address you are comfortable exposing, or use an alias.
The fake-site risk is bigger than the real-site risk. Type haveibeenpwned.com yourself. Never follow a link from an email or text that says your account was "pwned" and asks you to log in.
How to use Have I Been Pwned (2 minutes)
- Go to haveibeenpwned.com.
- Enter the email address you want to check and press the button.
- Read the result: a green "no pwnage found" message, or a red list of breaches with the site name, the date and the types of data exposed.
- Click each breach. The type of data matters more than the number of breaches.
- Repeat for every email address you have used, including old ones.
- Press "Notify me" to get an email if the address shows up in a future breach. You verify ownership with a link sent to that address.
If you use plus addresses like name+shop@example.com, HIBP can handle them; the FAQ explains how aliasing is treated.
What the results mean
A breach row tells you four things: which site was breached, when, how many accounts, and what was taken. Read the last one first.
| Data exposed | How serious | What to do |
|---|---|---|
| Email address only | Low. Expect more spam and phishing | Be careful with unexpected email, no rush |
| Email + password (hashed) | Medium to high if you reused it | Change that password everywhere you used it |
| Email + password (plain text) | High | Treat the password as public and change it today |
| Phone, address, date of birth | High for fraud and SIM-swap attempts | Lock down your phone account, watch for fraud |
| Payment or government ID data | Highest | Contact your bank, consider a credit freeze (see identitytheft.gov) |
HIBP also labels breaches, and the labels change how much weight to give them:
| Label | What it means | How to read it |
|---|---|---|
| Verified | The data was checked and is from the named site | Take it at face value |
| Unverified | The data looks real but could not be fully authenticated | Act as if it is real, it is still your address |
| Fabricated | Almost certainly not from the claimed site | Low concern, but the address is in a list |
| Sensitive | Being listed could harm you, so it is hidden from public search | Visible only after you verify the address by email |
| Stealer logs | Data collected by malware on an infected device | Scan the device too, not only the account |
| Spam list | Contact data aggregated for sending spam | Lower risk, expect more junk and phishing |
What "pwned" does not mean
Being pwned does not mean someone is logged in as you. It means a copy of some of your data left a company. Whether that leads to a takeover depends on two things: the password you used there, and where else you used it.
The attack that follows most leaks is credential stuffing. Criminals take leaked email and password pairs and try them on banks, email, shops and social networks, automatically. A password you used on only one site, long and random, is hard to turn into more damage. A password reused across ten sites is the real risk. If you want the mechanics, OWASP describes credential stuffing.
What to do if you are pwned: a first-hour plan
Secure your email first
Whoever controls your inbox can reset every other password. New password and two-factor authentication before anything else.
Change the breached account's password
Then change it everywhere you reused it. A password manager gives each site a unique one.
Turn on two-factor authentication
Email, banking and any account with payment details first. Prefer an authenticator app or a passkey over SMS.
Check what was exposed
Act on the worst item. Passwords and financial data come before an email-only leak.
Expect phishing with real details
A message that quotes a real site or a past order may be built from leaked data. Do not click, go to the site directly.
Set up breach alerts
Use the notification service on Have I Been Pwned so the next leak reaches you early.
You do not need to delete accounts or panic-change everything. The CISA guidance on strong passwords agrees with the basics: long, unique, and in a password manager. NIST's password guidelines also recommend that services check new passwords against known breached ones, which is exactly what Pwned Passwords is for.
How the Pwned Passwords check works (and why it doesn't see your password)
HIBP has a second tool, Pwned Passwords, that answers a different question: has this exact password ever appeared in a breach? It says nothing about who used it, only how many times it has been seen.
The trick is a technique called k-anonymity. Your browser hashes the password with SHA-1 locally and sends only the first five characters of the hash. The service returns every known hash that starts with those five characters, and your browser checks for a match on your own device.
For example, the SHA-1 hash of the word password is:
1. On your device
5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
The password is hashed with SHA-1 locally. This is the hash of the word password.
2. Sent to the service
5BAA6
Only the first five characters leave your device. Not the password, not the full hash.
3. Matched on your device
1E4C9B93F3F0682250B6CF8331B7EE68FD8
…and hundreds of other endings
The service returns every hash ending that shares the prefix. Your device checks for a match.
Only 5BAA6 is sent. The server replies with the long list of hash endings that share that prefix, and the comparison happens locally. The full password and the full hash never leave your machine. Cloudflare, which serves the traffic, explains the design in detail.
Even so, a good habit is to not type a real, current password into any website. Use the check in your password manager instead, many of which run this same lookup for you. A password that appears in the list should be retired for good, even if it was never "yours" in a breach.
What Have I Been Pwned can't tell you
| Question | Does HIBP answer it? |
|---|---|
| Was my email in a known breach? | Yes |
| What data was exposed and when? | Yes, per breach |
| Has this password been seen in a breach? | Yes, via Pwned Passwords |
| Was I in a breach nobody has published? | No |
| Is someone in my account right now? | No |
| Which of my accounts use this email? | No |
| What should I do next? | No, that part is yours |
Two kinds of exposure: what leaked, and what leaks right now
What leaked from a company
- Email, password, phone, name
- Happens at a company you used
- Check it on Have I Been Pwned
- Fix: unique passwords, two-factor, alerts
What your connection shows
- IP address, provider, city, DNS
- Happens on every site you open
- Check it on the Atomic VPN exposure panel
- Fix: a VPN changes what sites see
HIBP answers one question well: what already left a company's database. There is a second kind of exposure that no breach site covers, which is what your own connection shows to every site you visit today: your IP address, your internet provider, your approximate city, your DNS resolver.
We make a VPN, so here is the honest version. A VPN does nothing for data that has already been leaked. It cannot pull your email out of the Adobe breach. What it does is change the second list. On the Atomic VPN homepage there is a live exposure panel that shows your IP, ISP, city, device, browser and DNS as a website would see them. Open it before and after connecting and you will see which of those lines change. For more on what the connection layer reveals, see what an IP address reveals and how a VPN protects you.
There is also a point HIBP itself makes clear: VPN companies get breached too. HIBP lists a 2021 breach of several free VPN apps (SuperVPN, GeckoVPN and others) with 20.3 million email addresses and login histories (HIBP record, Malwarebytes report). The records included device details and when and from where people logged in. The lesson is not "avoid VPNs." It is that a provider can only leak what it keeps, so check what a VPN stores before you trust it, and don't sign up with your main email. Our own privacy policy lists what we don't keep: no timestamps, no assigned IPs, no per-user bandwidth, no DNS queries.
Open the exposure panel on atomicvpn.io and note your IP, provider and DNS. Connect, check again, and see which lines change.
How to avoid being pwned again
You cannot stop companies from being breached. You can limit the damage when they are.
- One password per site. The single biggest thing. A password manager makes it painless.
- Two-factor authentication on email and money accounts first. CISA has a short guide to turning on MFA.
- Use aliases for sign-ups. A separate address for shops and newsletters means a leak does not hand over the address you use for banking.
- Share less. Many sites ask for a date of birth or a phone number they do not need. Troy Hunt's own advice to Consumer Reports is to practise data minimisation (Consumer Reports).
- Keep devices clean. Stealer malware leaks everything you type, no matter how strong the password is. If you suspect it, see how to know if your phone is hacked.
- Shrink your trail. The less data about you exists, the less can leak. Our guide to your digital footprint covers a 30-minute cleanup.
Frequently asked questions
Is the website "Have I Been Pwned" legitimate?
Yes. It is run by security researcher Troy Hunt, has operated since 2013, and its data is used by password managers and by Consumer Reports in its advice. Always type the address yourself instead of following a link.
Is Have I Been Pwned safe?
Yes, for checking an email address. The site says searches are not logged and that it does not store passwords next to emails. You cannot prove any site isn't logging, so use an alias if that matters to you.
Is it safe to put my email on "Have I Been Pwned"?
It is low-risk. An email address alone is not enough to access an account, and the site says it is not collecting searched addresses. Do not enter your password into the email search, and never into a lookalike site.
What does "pwned" mean?
It is hacker slang for "compromised" or "owned." In this context it means your data appeared in a known breach.
Which password should never be used?
Any password that appears in Pwned Passwords, any reused password, and common choices like 123456 or password. A long, unique password stored in a password manager is the safe default.
What does it mean if my email was found?
Your address was in a dataset that leaked from a company, possibly with a password, name or other details. Open the breach row, see what was exposed, and follow the steps above. It does not mean someone is in your account.
What does it mean if my email was not found?
It means the address is not in any breach HIBP has loaded. Some breaches are never discovered, and sensitive ones are hidden until you verify the address, so it is good news but not a guarantee.
Does Have I Been Pwned store my password?
No. The email search stores no passwords. The Pwned Passwords tool only receives the first five characters of a hashed password and returns matching hashes for your device to compare.
Can Have I Been Pwned check my phone number?
The search box on the site asks for an email address. A phone lookup was added after the 2021 Facebook leak, but it is not the main feature today. Watch for suspicious codes and calls instead.
Is Have I Been Pwned free?
Checking an email and checking a password are free, and so is email notification. Paid plans exist for developers and companies that need higher API limits.
What is a sensitive breach?
A breach where being listed could harm you, such as adult sites. It is hidden from public search and shown only after you verify the email address through a sign-in link (HIBP FAQ).
Can a VPN protect me from data breaches?
No. A breach happens at the company that stores your data, not on your connection. A VPN helps with a different problem: what your network connection reveals while you browse (more in is a VPN worth it). For breaches, use unique passwords, two-factor authentication and breach alerts.
What are good alternatives to Have I Been Pwned?
Firefox's Monitor service uses HIBP data and keeps watching for new breaches. Most password managers also run a built-in breached-password check.
What to take away
If you have never checked, do it now: one search, two minutes. If you are pwned, the response is dull and effective: secure the email, make every password unique, turn on two-factor, and ignore messages that try to scare you into clicking. A VPN is a good tool for a different job, and the honest way to use both is to fix the leak with passwords and use the VPN for what your connection gives away today.
