HaveIBeenPwned

About HaveIBeenPwned

HaveIBeenPwned's API v3 is a RESTful service for searching pwned email addresses and passwords. It supports searching breaches for a specific email address either by sending the address directly to the API or via a privacy-preserving k-anonymity hash range lookup, and returns matching breach names by default or the full breach model on request. It also covers domain search (verifying domains via DNS or email, then listing all breached email addresses for a domain or all subscribed domains), retrieval of all breaches in the system, a single breach by name, the most recently added breach, and data classes, plus paste data associated with an email address and stealer log lookups (domains for an email address, email addresses for a website domain, and email aliases for an email domain).

Authorization via an "hibp-api-key" header is required for email address search, domain search, paste search, and stealer log endpoints; the Pwned Passwords API (hash-range search, NTLM hash search, and full hash list download) requires no authorization. A test API key is available for use against designated test email addresses in place of a paid subscription. Every request must include a descriptive user-agent header, and endpoint availability varies by subscription tier (Core, Pro, High RPM). An MCP server is also published, exposing HIBP's breach metadata, Pwned Passwords, stealer logs, domain workflows, and subscriber features to AI agents and MCP-capable clients via the Model Context Protocol.

This API is intended for developers building applications that check email addresses, domains, or passwords against known data breaches, such as security tools, identity monitoring services, or password validation features.

Key features

• Search for pwned email addresses across known data breaches
• Privacy-preserving k-anonymity hash range search for email addresses
• Domain search to find all breached email addresses for a verified domain
• Free Pwned Passwords API to check password hashes (including NTLM) against breach data
• Stealer log lookups by email address or website/email domain
• MCP server exposing HIBP tools for AI agents and MCP-capable clients

Frequently asked questions