Have I Been Pwned Review 2026: The Free Breach Checker Everyone Should Use

Short answer: Have I Been Pwned (HIBP) is a free service, run by security researcher Troy Hunt since 2013, that tells you whether your email address appears in known data breaches. It's trusted across the security industry — governments and password managers use it — and it costs nothing for individuals. Use it to check your emails, sign up for breach notifications, and check passwords safely with its k-anonymity Pwned Passwords service.

What HIBP does

• Email search: enter an email address to see which known breaches included it and what data was exposed (passwords, phone numbers, addresses and so on).
• Notify me: get an email if your address appears in a future breach.
• Pwned Passwords: check whether a password has appeared in breaches, without sending the password itself.
• Domain search: organizations can see breached accounts on domains they control.

How Pwned Passwords stays private

When you check a password, your browser hashes it (SHA-1) and sends only the first five characters of that hash. HIBP returns every breached hash starting with those characters, and your browser checks for a match locally. HIBP never sees your password or even its full hash. This technique is called k-anonymity, and it's why password managers like 1Password and Bitwarden can integrate the service safely.

You can try it on our Pwned Password Checker, which uses the same API.

What to do if your email shows up

1. Look at what was exposed. A breach that leaked passwords is more urgent than one that leaked only email addresses.
2. Change the password on that site — and everywhere you reused it. Credential stuffing (trying leaked passwords on other sites) is how most breaches spread; see our guide on credential stuffing.
3. Turn on two-factor authentication, ideally with an authenticator app or passkey.
4. Use a password manager so every account has a unique password (Bitwarden is free).
5. Watch for phishing that references the breached service — attackers use breach data to make scams convincing.
6. If financial or ID data leaked, freeze your credit at the three US bureaus (free).

Limitations

• Only known, verified breaches are included; many leaks are never made public.
• It tells you about exposure, not misuse. Being in a breach doesn't mean your account was taken over.
• Sensitive breaches are hidden from public search and only shown to verified owners of the email address.

HIBP vs. paid dark web monitoring

Paid identity protection services such as Aura monitor for more data types (SSNs, bank numbers) and offer recovery help. For email and password exposure alone, HIBP's free notifications cover most of what you need. See how dark web monitoring actually works.

Verdict

Have I Been Pwned is one of the most useful free security tools on the internet. Every person should check their email addresses, sign up for notifications and use a password manager that checks against Pwned Passwords.

Frequently asked questions

Is Have I Been Pwned safe to use?

Yes. It's run by a well-known security researcher, used by governments and security companies, and its password check never receives your actual password.

What does it mean if I've been "pwned"?

Your email address was included in data from a known breach. Change the affected passwords, enable two-factor authentication and stop reusing passwords.

Is Have I Been Pwned free?

Yes for individuals. Organizations pay for some domain-search and API features.

Sources

• Have I Been Pwned, About
• Troy Hunt, Understanding Have I Been Pwned's use of SHA-1 and k-anonymity
• Have I Been Pwned, Pwned Passwords