Have I Been Pwned

Have I Been Pwned (HIBP) is our editors’ choice breach-notification service for 2026. Not because it magically undoes leaked credentials, but because it remains the clearest, most trustworthy public answer to “did this email show up in a known dump?”—built and maintained by security researcher Troy Hunt, free for individuals, and honest about what a breach search can and cannot do. If you only do one hygiene check after every headline breach, do it here.

This review is for US and UK individuals, freelancers, and small-team admins who need a practical breach workflow—not a subscription “identity protection” brochure that wraps the same public data in fear.

Quick verdict

Have I Been Pwned earns 4.9 / 5 and our editors’ choice badge for personal breach awareness. Search your addresses on haveibeenpwned.com, enroll Notify Me for every address you still use, and treat a hit as a password-change + 2FA checklist, not as antivirus day. Pair HIBP with a real password manager (Bitwarden is our editors’ choice) so Pwned Passwords checks and unique credentials become automatic. Skip paid “dark web scan” upsells that mainly rebrand the same public breach awareness HIBP already gives you for free.

STA score context: unmatched public trust, clarity, and usefulness for individuals; incomplete coverage of undisclosed dumps and “search ≠ remediation” keep it just under a perfect 5.

What is Have I Been Pwned?

Have I Been Pwned is a free web service that indexes publicly known data breaches and lets you check whether an email address (or, via related tools, a password) appears in that corpus. Troy Hunt built it as a public-interest project: ingest verified breach data, attribute sources transparently, and give people a single place to learn they were in a dump—often before a company’s marketing email arrives.

Core jobs:

• Search an email against known breach records and see which incidents apply
• Subscribe with Notify Me so future ingested breaches trigger an alert
• Power Pwned Passwords so apps and password managers can reject known-compromised secrets without uploading your full password in the clear
• Offer domain search / API options for organizations that need structured monitoring

What it is not: antivirus, antimalware, a VPN, a credit-freeze service, a full “identity theft protection” suite, or proof that an unlisted address is safe forever. HIBP answers a narrow question extremely well. Confusing it with endpoint protection is how people skip Windows Security updates and still feel “covered.”

Core features that matter

1. Breach search for email addresses

Paste an address, get a list of breaches HIBP associates with it, plus human-readable context about what data classes were exposed (passwords, phone numbers, physical addresses, and so on—varies by incident). The value is triage: you learn which sites need immediate password changes and what category of data was leaked, so you do not panic-rotate every login on earth in random order.

Use every address you actually receive mail on: personal Gmail/Outlook, work aliases that forward, old university accounts, and shopping-only aliases. One forgotten Hotmail that still receives password resets is enough to keep you exposed.

2. Notify Me (ongoing monitoring)

One-off searches are how people forget. Notify Me registers your interest so when HIBP later ingests a breach containing your address, you get notified. That is the individual feature we treat as mandatory in 2026. Breach disclosure timelines are messy; HIBP often surfaces usable awareness faster than waiting for a brand’s carefully lawyered email.

Enroll each address separately. Keep the confirmation mail. Do not rely on a spouse’s search of your shared Netflix email as your personal monitoring plan.

3. Pwned Passwords

Pwned Passwords is the other half of HIBP’s public value: a massive list of passwords that have appeared in breaches, queryable with k-anonymity (you send a password hash prefix; the service returns matching suffixes). Password managers and websites use this pattern to warn “this secret is already in dumps—pick another” without shipping your full password to HIBP.

For users: enable breach/password warnings inside your vault. For builders: do not reinvent a plaintext password upload “checker.” Use the documented range API. This feature is why HIBP sits upstream of modern password hygiene, not just news-cycle panic.

4. Transparency and sourcing culture

HIBP’s reputation comes from careful ingestion: verifying dumps, documenting sources, and resisting the scrapey “we bought a Telegram channel” marketing tone common in identity-protection ads. That culture matters when you are deciding whether to trust a free security site with your email address for Notify Me. You still should use a unique password manager entry for any HIBP-related account surfaces and treat confirmation links carefully—phishing clones of popular security brands are a real problem.

5. Domain and API reality for teams

Individuals live on the public search + Notify Me path. Organizations with a verified domain can see addresses on that domain appearing in breaches—useful for IT after a vendor incident or for chasing stale accounts. Paid API tiers exist for higher volume and automation. If you run a 200-person company, do not pretend browser searches of the CEO’s Gmail replace domain monitoring and an incident runbook.

What Have I Been Pwned is not (read this twice)

HIBP will not:

• Remove malware from your PC or phone
• Tell you whether a brand-new zero-day phishing kit already stole today’s session cookies
• Guarantee every underground dump is indexed the day it appears
• Replace unique passwords, a password manager, or multi-factor authentication
• Freeze your credit or dispute fraudulent bank charges

If a breach included malware distribution or stealer logs, you may need endpoint cleanup (Malwarebytes Premium or your preferred cleaner) in addition to credential rotation. If the breach was “just” email/password pairs, the priority is credentials and sessions—not downloading three trial antivirus suites.

Hands-on / lab notes

Task	Result
Search primary personal email	Instant; clear breach cards with data classes
Search old unused address	Often the messiest—many forgotten shopping sites
Enroll Notify Me	Smooth confirmation flow; keep the mailbox alive
Check password via manager’s HIBP integration	Works well in Bitwarden-class vaults using range API
Assume “no hits = forever safe”	Wrong mental model—coverage is known dumps only
Respond to a password-including breach	Password change + 2FA + session revoke beat panic scanning
Compare to paid “dark web monitor” ads	Overlap is high; HIBP remains the transparent baseline

Breach week playbook that works: HIBP hit → open the breach detail → identify sites that reused that password → change those passwords in your manager to unique random values → enable 2FA where missing → revoke sessions/app passwords on high-value accounts (email, banking, Apple/Google) → only then decide if malware cleanup is relevant. Do not start by reformatting Windows because LinkedIn leaked hashes in 2012.

HIBP vs password-manager monitoring

Modern password managers increasingly warn when a saved login appears in known breaches or when a password is on the Pwned Passwords list. That is excellent—and it often uses HIBP data or the same class of corpus. The difference:

• HIBP Notify Me watches the email address across breaches, including sites you never saved in the vault (or saved under a different identity).
• Vault monitoring watches the logins you stored and the strength/reuse of those secrets.

You want both. A manager without breach checks still beats sticky notes; HIBP without unique passwords just emails you about the next dump of the same Summer2019! reuse. STA recommendation: Bitwarden (or your chosen vault) as daily driver + HIBP Notify Me on every active address.

Pricing and editions

Edition	Cost	Best for
Public email search	Free	Everyone, every breach headline
Notify Me	Free	Ongoing personal monitoring
Pwned Passwords (documented API)	Free for reasonable public use	Sites, vaults, builders
Domain search / subscription API	Paid (org tiers)	Companies verifying domains and automating checks

There is no consumer “HIBP Premium antivirus.” Paid surfaces are for organizational scale and API access. Individuals should be suspicious of third-party ads that imply you must pay a monthly identity fee to “use Have I Been Pwned properly.”

Who should use it?

Use Have I Been Pwned (editors’ choice) if you:

• Want a trustworthy free check after breach news
• Will enroll Notify Me on every address you still control
• Pair results with a password manager and 2FA, not vibes
• Need a clear public explanation of what data class was exposed
• Are tired of paid dark-web theater for the same awareness job

Skip treating HIBP as complete protection if you:

• Need endpoint antimalware (wrong tool)
• Expect every private stealer log to appear instantly
• Refuse to change reused passwords after a confirmed hit
• Run enterprise fleet compliance without domain/API workflows

Alternatives to consider

Alternative	Best when
Password manager breach alerts (Bitwarden, etc.)	You want checks tied to saved logins and password reuse
Vendor breach emails	Official notice + remediation steps from the breached company
Paid identity monitoring suites	You explicitly want credit monitoring / insurance-style extras (not HIBP’s job)
Enterprise CASB / dark-web brand monitoring	Corporate brand abuse and executive threat intel beyond personal email search
Manual “change password everywhere” without data	Never—use HIBP to prioritize

See the tools directory for password managers and security utilities that complete the stack.

Practical week-one playbook

Day 1: Search every email you actively use; screenshot or note breach names that include passwords.
Day 2: Enroll Notify Me for each address; confirm from the correct inbox.
Day 3: In your password manager, run a health/breach report; kill reused passwords on hit sites first.
Day 4: Turn on 2FA for email, banking, Apple/Google/Microsoft accounts if missing.
Day 5: Revoke old app passwords and unfamiliar sessions on those high-value accounts.
Weekend: Teach one relative to use HIBP without downloading “breach cleaner” scareware from ads.

Power-user notes

For developers, integrate Pwned Passwords with k-anonymity—never POST full passwords to random checkers. For households, maintain a written list of addresses enrolled in Notify Me (including kids’ school aliases if appropriate). For incident response at work, combine domain search with forced resets and MFA enrollment; HIBP is intelligence, not your IdP.

Final score: 4.9 / 5 (Editors’ Choice)

Have I Been Pwned remains the public-interest breach service we tell everyone to use in 2026: free search, Notify Me, and Pwned Passwords with a trust model that paid scare products rarely match. It will not patch your browser or invent passwords for you—and that honesty is why it earns editors’ choice.

FAQ

Is Have I Been Pwned free?
Yes for individual search, Notify Me, and normal Pwned Passwords usage. Organizations pay for higher-volume API and domain-oriented workflows.

Is Have I Been Pwned an antivirus?
No. It reports known breaches involving your email (and powers password checks). It does not scan disks or block malware.

What should I do if I am in a breach?
Change the password on that site to a unique manager-generated secret, enable 2FA, revoke sessions if available, and change any other site where you reused the old password.

How is Notify Me different from a one-time search?
Search is a snapshot. Notify Me alerts you when newly ingested breaches include your address later.

Does a clean HIBP result mean I am safe?
No. It means you were not in the breaches HIBP currently indexes. Undisclosed dumps and phishing still exist—use unique passwords and 2FA anyway.

HIBP vs password manager monitoring?
Use both. HIBP watches addresses across breaches; your vault watches stored logins and known-bad passwords.

Who runs Have I Been Pwned?
Security researcher Troy Hunt. Prefer the official site haveibeenpwned.com over lookalike domains and “breach repair” ads.