Have I Been Pwned indexes billions of credentials from public breaches and tells you which of your addresses appear in them, which is the fastest way to find out that an old account you forgot about is circulating in a combo list. Domain owners can subscribe to alerts when staff addresses show up.
Who it is for
A security lead checking whether staff addresses appear in a newly published breach dump.
Key features
- Searches billions of breached credentials
- Email alerts for new breach appearances
- Domain search and monitoring for staff
- Pwned Passwords check by hash prefix
- Paid API key for programmatic checks
- Only covers publicly surfaced breaches
Where it falls short
It only knows about breaches that have surfaced publicly, so a clean result is not proof of safety, and it tells you nothing about what to do next beyond changing the password.
Pricing
Free for individual email and password checks; the API key and domain monitoring are paid subscriptions, and the API is the gate most teams hit.
Prices move; the tier structure is the part that stays true. Check current pricing on Have I Been Pwned.
Alternatives to Have I Been Pwned
Frequently asked
Is Have I Been Pwned free?
Yes. Free for individual email and password checks; the API key and domain monitoring are paid subscriptions, and the API is the gate most teams hit.
What is Have I Been Pwned best for?
A security lead checking whether staff addresses appear in a newly published breach dump.
What are the best alternatives to Have I Been Pwned?
The closest substitutes we list are Bitwarden and Ente Auth. They sit in a similar price bracket but make a different trade-off, so read the weaknesses section of each review before switching.
Which platforms does Have I Been Pwned run on?
Have I Been Pwned is available on Web.