Have I Been Pwned Review 2026: The Free Breach-Checking Standard

Have I Been Pwned (HIBP), built and maintained by security researcher Troy Hunt since 2013, is the closest thing the industry has to a canonical, free breach-checking database. Enter an email address and it checks that address against hundreds of aggregated breach datasets, showing you exactly which breaches exposed it and what data was included. Over more than a decade of operation, it has become the reference point that journalists, security researchers, and even government agencies cite when discussing the scale of a newly disclosed breach.

What It Checks

Beyond the free email lookup, HIBP's Pwned Passwords feature lets you (or, more usefully, your own applications via its API) check whether a specific password has appeared in a known breach corpus, using k-anonymity so the full password is never transmitted or logged. This has become a de facto industry standard, integrated directly into password managers and browsers like Firefox and Chrome. The k-anonymity design is worth understanding: your device only sends the first five characters of the password's hash to HIBP's servers, which return a list of matching hash suffixes for your device to check locally — meaning HIBP never actually sees the full password or its complete hash.

Free Email Breach Lookup

K-Anonymity Password Checking API

Domain-Wide Monitoring For Businesses

Used By Firefox, 1Password, and Others

The domain-monitoring subscription (aimed at businesses and IT admins) adds ongoing notification whenever any address on a verified domain shows up in a new breach, which is genuinely useful for security teams tracking employee credential exposure at scale. This is a meaningfully different use case from the free consumer lookup and reflects HIBP's dual role as both a public good and a paid enterprise data source.

How It Compares

Unlike DeleteMe or Incogni, HIBP doesn't remove anything — it's purely a detection and awareness tool, telling you what's already exposed rather than fixing the exposure. Compared to the breach-monitoring features built into paid identity-protection services like Aura or Norton LifeLock, HIBP's dataset is arguably more comprehensive since it's been aggregating breaches publicly for over a decade and is often the first place a new breach's data appears for public lookup. What it lacks is the ongoing active alerting and identity-restoration support those paid services provide once something is actually found.

Pricing

The core email and password lookup tools are entirely free with no account required, funded by the paid domain-monitoring subscriptions and Pwned Passwords API commercial tier for high-volume enterprise use. There's also a free notification signup for individuals who want to be emailed automatically whenever their address appears in a newly loaded breach, rather than needing to manually check back.

Who It's For

Have I Been Pwned should be the first tool anyone reaches for when checking whether an email or password has ever leaked, and it's essential for developers building signup or password-reset flows who want to reject known-compromised passwords using the API. Businesses managing a domain's worth of employee accounts get real value from the paid monitoring tier, while individual users get everything they need from the free lookup and notification signup.

Where It Falls Short

Only As Complete As Reported Breaches

No Active Monitoring On Free Tier

No Remediation Tools Included

HIBP only knows about breaches that have been publicly reported and loaded into its dataset — it can't detect a breach that hasn't surfaced yet — and the free tier is a one-time lookup rather than ongoing alerting (that requires a separate notification signup, which is free, or the paid domain tier for organizations). It also doesn't help you actually fix anything; it only tells you what's already exposed, leaving the password reset, card cancellation, or credit freeze entirely up to you.

Verdict

Have I Been Pwned should be the first stop for anyone checking whether their email or passwords have leaked — it's free, fast, and trusted enough that major browsers and password managers build directly on its data. Pair it with a paid identity-monitoring or data-removal service if you want ongoing, proactive protection rather than a point-in-time check.