What is Have I Been Pwned and who runs it?
Have I Been Pwned (HIBP) is a breach-notification service created by Troy Hunt, an Australian Microsoft Regional Director and long-standing security educator. Since 2013 the project has aggregated billions of affected accounts, often serving as the public fact-check when journalists and users ask, “Was I in that breach?”
Its longevity matters: Hunt’s public writing, conference talks, and conservative approach to publishing raw data have made HIBP a de facto standard for consumer-grade breach disclosure—even when commercial vendors later repackage the same incidents.
How HIBP gets its breach data
Entries typically flow from three channels: trusted researchers submitting newly discovered dumps, operators indexing public leak disclosures once ethics and legality allow, and partners feeding normalized breach datasets under agreed terms. Each incident is described with fields such as breach date, compromised attributes, and verification status rather than exposing the underlying secrets.
Hunt has repeatedly documented the verification workflow—rejecting noisy spam lists, separating marketing databases from credential leaks, and flagging uncertain provenance. That process is why HIBP feels slower than rumor-mill forums but more dependable for regulated conversations.
What HIBP is accurate about
- Well-documented public breaches generally match what enterprises later confirm in SEC filings or regulator notices.
- Data classes (e.g., passwords, physical addresses, security questions) are useful for triage even when you still need internal log review.
- Update cadence improves once disclosures stabilize; HIBP often reflects the industry consensus after initial chaos.
Where HIBP has limitations
- Not real-time. Breaches can circulate in private channels for weeks before they are verified and published. Absence of a result today is not a guarantee of safety tomorrow.
- Dark web blind spots. Entire classes of brokered data never become public enough to index responsibly. HIBP is not a dark-web monitoring product.
- Limited incident response context. Knowing that “passwords” leaked does not grade severity for your org, map to SOC detections, or assign accountability.
- Unverified flags. Some rows remain tentative; security teams should correlate with threat intel feeds or vendor reports before treating them as audit facts.
Privacy: is it safe to enter your email?
For password checks, HIBP popularized k-anonymity: only a small slice of a hash is sent to retrieve a bloom-filter-style answer, limiting exposure of the full secret. Email lookups use a hashed prefix technique so the full address is not broadcast in the clear to third-party analytics providers as part of the query flow.
Policies evolve; the definitive reference is Hunt’s privacy write-up on haveibeenpwned.com. Enterprises should still route employee checks through approved tooling if your legal team restricts submitting work emails to external sites.
Verdict: reliable for what it does, limited in scope
Have I Been Pwned remains a trustworthy index of many high-signal breaches, with transparent sourcing and a track record of correcting mistakes publicly. It is less suited as an all-in-one defense program: you still need monitoring, MFA enforcement, logging, vendor risk reviews, and human runbooks.
For readers who want the same baseline dataset interpreted into “what to do Monday morning,” compare modern HIBP alternatives that bundle alerts and recovery guidance—not only historical tables.
SecurityScore.me uses breach intelligence and adds monitoring
Start with a clear breach picture, then keep watching the addresses you care about. SecurityScore.me is designed to pair data-driven results with actionable recovery steps and optional alerting when new incidents land.
FAQ
Can I trust a breach result on Have I Been Pwned?
For major public incidents, HIBP is generally accurate about whether an email appeared in a disclosed dataset. Treat edge cases, unverified dumps, and timing delays as reasons to corroborate with your own logs.
Does HIBP see every leak on the internet?
No. It focuses on documented breaches and carefully sourced data. Underground chatter, private negotiations, and leaks that never surface publicly may never appear.
Why do some breaches show as unverified?
The operator distinguishes entries with incomplete provenance or conflicting evidence to avoid overstating certainty. That transparency is a feature, not a bug.
Is it safe to type my email into HIBP?
HIBP publishes detailed privacy practices, including approaches like k-anonymity for password range searches and hashed prefixes for email lookups. Read the current policy on haveibeenpwned.com before deciding for regulated workloads.
What should I use if I need alerts and playbooks?
Pair authoritative breach data with a monitoring product that tells you when new incidents affect saved addresses and outlines recovery priorities—such as SecurityScore.me.