Have I Been Pwned website screenshot

Have I Been Pwned

Have I Been Pwned (HIBP) is a free service operated by Troy Hunt that lets individuals and organizations check whether their email addresses, phone numbers, passwords, or domains have appeared in known data breaches, pastes, or stealer logs. The service aggregates billions of compromised records and exposes both free and paid endpoints, including the k-anonymity Pwned Passwords API. The v3 REST API at haveibeenpwned.com requires an hibp-api-key header for breach, paste, domain, and stealer log endpoints and is offered across Core, Pro, and High RPM subscription tiers.

Have I Been Pwned publishes 14 APIs on the APIs.io network, including Breach API, Breachedaccount API, Breacheddomain API, and 11 more. Tagged areas include Security, Data Breaches, Pwned Passwords, Identity, and Threat Intelligence.

Have I Been Pwned’s developer surface includes authentication, documentation, pricing, signup flow, FAQ, engineering blog, and 7 more developer resources.

🌐 Visit website 📡 Source on GitHub
28.1/100 thin ▬ flat Agent 47/100 agent ready Full breakdown ↓
scored 2026-07-28 · rubric v0.6
AccessSelf serve
16 APIs
SecurityData BreachesPwned PasswordsIdentityThreat IntelligenceCredential Stuffing

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-07-28 · rubric v0.6
Composite quality — 28.1/100 · thin
Contract Quality 13.6 / 25
Developer Ergonomics 4.3 / 20
Commercial Clarity 2.1 / 20
Operational Transparency 0.7 / 13
Governance 0.0 / 12
Discoverability 7.4 / 10
Agent readiness — 47/100 · agent ready
Machine-Readable Contract 18 / 18
Agentic Access Contract 10 / 10
MCP Server 0 / 12
Machine-Readable Auth 10 / 10
Idempotency 0 / 9
Stable Error Semantics 8 / 8
Request/Response Examples 7 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 0 / 6
Agent Skills 0 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/have-i-been-pwned: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 16

Individual APIs this provider publishes, each with its own machine-readable definition.

Have I Been Pwned API v3

REST API for searching breached accounts, pastes, breach metadata, domain breach data, and stealer log entries. Authentication requires an hibp-api-key header (32-character key)...

Pwned Passwords API

Free, unauthenticated, k-anonymity-based API to check whether a password hash appears in the 800+ million record Pwned Passwords dataset. Clients submit the first five character...

Have I Been Pwned Breach API

The Breach API from Have I Been Pwned — 1 operation(s) for breach.

Have I Been Pwned Breachedaccount API

The Breachedaccount API from Have I Been Pwned — 2 operation(s) for breachedaccount.

Have I Been Pwned Breacheddomain API

The Breacheddomain API from Have I Been Pwned — 1 operation(s) for breacheddomain.

Have I Been Pwned Breaches API

The Breaches API from Have I Been Pwned — 1 operation(s) for breaches.

Have I Been Pwned Dataclasses API

The Dataclasses API from Have I Been Pwned — 1 operation(s) for dataclasses.

Have I Been Pwned Domainverification API

The Domainverification API from Have I Been Pwned — 3 operation(s) for domainverification.

Have I Been Pwned Latestbreach API

The Latestbreach API from Have I Been Pwned — 1 operation(s) for latestbreach.

Have I Been Pwned Pasteaccount API

The Pasteaccount API from Have I Been Pwned — 1 operation(s) for pasteaccount.

Have I Been Pwned Range API

The Range API from Have I Been Pwned — 1 operation(s) for range.

Have I Been Pwned Stealerlogsbyemail API

The Stealerlogsbyemail API from Have I Been Pwned — 1 operation(s) for stealerlogsbyemail.

Have I Been Pwned Stealerlogsbyemaildomain API

The Stealerlogsbyemaildomain API from Have I Been Pwned — 1 operation(s) for stealerlogsbyemaildomain.

Have I Been Pwned Stealerlogsbywebsitedomain API

The Stealerlogsbywebsitedomain API from Have I Been Pwned — 1 operation(s) for stealerlogsbywebsitedomain.

Have I Been Pwned Subscribeddomains API

The Subscribeddomains API from Have I Been Pwned — 1 operation(s) for subscribeddomains.

Have I Been Pwned Subscription API

The Subscription API from Have I Been Pwned — 1 operation(s) for subscription.

Scroll for all 16

Open Collections 1

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

Have I Been Pwned API v3

OPEN COLLECTION

Security Posture 3

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Have I Been Pwned Authentication

apiKey · 1 scheme

SECURITY

Have I Been Pwned Domain Security

TLSv1.3 · HSTS · DNSSEC · DMARC

SECURITY

Have I Been Pwned Vulnerability Disclosure

security.txt · contact published

SECURITY

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Have I Been Pwned Agentic Access

17 operations · 3 acting

17 operations · 3 acting

AGENTIC

Resources

Get Started 1

Portal, sign-up, and the first successful call

Signup
Signup

Documentation 1

Reference material describing how the API behaves

Documentation
Documentation

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

AgenticAccess
AgenticAccess

Build 1

SDKs, sample code, and the tooling you integrate with

GitHubOrganization
GitHubOrganization

Access & Security 3

Authentication, authorization, and security posture

VulnerabilityDisclosure
VulnerabilityDisclosure
 DomainSecurity
DomainSecurity
 Authentication
Authentication

Operate 1

Status, limits, changes, and where to get help

FAQ
FAQ

Commercial 1

Pricing, plans, and the legal terms of use

Pricing
Pricing

Company 4

The organization behind the API

LinkedIn
LinkedIn
 Website
Website
 Blog
Blog
 Twitter
Twitter

Source (apis.yml)

apis.yml Raw ↑ 
aid: have-i-been-pwned
name: Have I Been Pwned
description: Have I Been Pwned (HIBP) is a free service operated by Troy Hunt that lets individuals and organizations check
  whether their email addresses, phone numbers, passwords, or domains have appeared in known data breaches, pastes, or stealer
  logs. The service aggregates billions of compromised records and exposes both free and paid endpoints, including the k-anonymity
  Pwned Passwords API. The v3 REST API at haveibeenpwned.com requires an hibp-api-key header for breach, paste, domain, and
  stealer log endpoints and is offered across Core, Pro, and High RPM subscription tiers.
type: Index
accessModel:
  pricing: unknown
  onboarding: self-serve
  trial: false
  try_now: false
  public: false
  label: Self-serve signup
  confidence: medium
  source:
  - authentication
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/have-i-been-pwned.png
tags:
- Security
- Data Breaches
- Pwned Passwords
- Identity
- Threat Intelligence
- Credential Stuffing
url: https://raw.githubusercontent.com/api-evangelist/have-i-been-pwned/refs/heads/main/apis.yml
created: '2026-05-11'
modified: '2026-05-11'
specificationVersion: '0.19'
apis:
- aid: have-i-been-pwned:api-v3
  name: Have I Been Pwned API v3
  description: REST API for searching breached accounts, pastes, breach metadata, domain breach data, and stealer log entries.
    Authentication requires an hibp-api-key header (32-character key) along with a descriptive user-agent header. Most endpoints
    require a paid subscription; rate limits range from 600 to 100,000 requests per minute depending on tier.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Breaches
  - Pastes
  - Stealer Logs
  - Domain Search
  - Account Search
  properties:
  - type: Documentation
    url: https://haveibeenpwned.com/API/v3
  - type: Authentication
    url: https://haveibeenpwned.com/API/Key
  - type: Pricing
    url: https://haveibeenpwned.com/API/Key
- aid: have-i-been-pwned:pwned-passwords
  name: Pwned Passwords API
  description: Free, unauthenticated, k-anonymity-based API to check whether a password hash appears in the 800+ million record
    Pwned Passwords dataset. Clients submit the first five characters of a SHA-1 hash and receive a list of matching suffixes
    with counts. No rate limit and no attribution required.
  humanURL: https://haveibeenpwned.com/API/v3#PwnedPasswords
  baseURL: https://api.pwnedpasswords.com
  tags:
  - Passwords
  - K-Anonymity
  - SHA-1
  - Credential Stuffing
  properties:
  - type: Documentation
    url: https://haveibeenpwned.com/API/v3#PwnedPasswords
  - type: Project
    url: https://haveibeenpwned.com/Passwords
- aid: have-i-been-pwned:have-i-been-pwned-breach-api
  name: Have I Been Pwned Breach API
  description: The Breach API from Have I Been Pwned — 1 operation(s) for breach.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Breach
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-breach-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-breachedaccount-api
  name: Have I Been Pwned Breachedaccount API
  description: The Breachedaccount API from Have I Been Pwned — 2 operation(s) for breachedaccount.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Breachedaccount
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-breachedaccount-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-breacheddomain-api
  name: Have I Been Pwned Breacheddomain API
  description: The Breacheddomain API from Have I Been Pwned — 1 operation(s) for breacheddomain.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Breacheddomain
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-breacheddomain-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-breaches-api
  name: Have I Been Pwned Breaches API
  description: The Breaches API from Have I Been Pwned — 1 operation(s) for breaches.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Breaches
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-breaches-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-dataclasses-api
  name: Have I Been Pwned Dataclasses API
  description: The Dataclasses API from Have I Been Pwned — 1 operation(s) for dataclasses.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Dataclasses
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-dataclasses-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-domainverification-api
  name: Have I Been Pwned Domainverification API
  description: The Domainverification API from Have I Been Pwned — 3 operation(s) for domainverification.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Domainverification
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-domainverification-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-latestbreach-api
  name: Have I Been Pwned Latestbreach API
  description: The Latestbreach API from Have I Been Pwned — 1 operation(s) for latestbreach.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Latestbreach
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-latestbreach-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-pasteaccount-api
  name: Have I Been Pwned Pasteaccount API
  description: The Pasteaccount API from Have I Been Pwned — 1 operation(s) for pasteaccount.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Pasteaccount
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-pasteaccount-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-range-api
  name: Have I Been Pwned Range API
  description: The Range API from Have I Been Pwned — 1 operation(s) for range.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Range
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-range-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-stealerlogsbyemail-api
  name: Have I Been Pwned Stealerlogsbyemail API
  description: The Stealerlogsbyemail API from Have I Been Pwned — 1 operation(s) for stealerlogsbyemail.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Stealerlogsbyemail
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-stealerlogsbyemail-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-stealerlogsbyemaildomain-api
  name: Have I Been Pwned Stealerlogsbyemaildomain API
  description: The Stealerlogsbyemaildomain API from Have I Been Pwned — 1 operation(s) for stealerlogsbyemaildomain.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Stealerlogsbyemaildomain
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-stealerlogsbyemaildomain-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-stealerlogsbywebsitedomain-api
  name: Have I Been Pwned Stealerlogsbywebsitedomain API
  description: The Stealerlogsbywebsitedomain API from Have I Been Pwned — 1 operation(s) for stealerlogsbywebsitedomain.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Stealerlogsbywebsitedomain
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-stealerlogsbywebsitedomain-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-subscribeddomains-api
  name: Have I Been Pwned Subscribeddomains API
  description: The Subscribeddomains API from Have I Been Pwned — 1 operation(s) for subscribeddomains.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Subscribeddomains
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-subscribeddomains-api-openapi.yml
- aid: have-i-been-pwned:have-i-been-pwned-subscription-api
  name: Have I Been Pwned Subscription API
  description: The Subscription API from Have I Been Pwned — 1 operation(s) for subscription.
  humanURL: https://haveibeenpwned.com/API/v3
  baseURL: https://haveibeenpwned.com/api/v3
  tags:
  - Subscription
  properties:
  - type: OpenAPI
    url: openapi/have-i-been-pwned-subscription-api-openapi.yml
common:
- type: AgenticAccess
  url: agentic-access/have-i-been-pwned-agentic-access.yml
- type: VulnerabilityDisclosure
  url: security/have-i-been-pwned-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/have-i-been-pwned-domain-security.yml
- type: Authentication
  url: authentication/have-i-been-pwned-authentication.yml
- type: GitHubOrganization
  url: https://github.com/HaveIBeenPwned
- type: LinkedIn
  url: https://www.linkedin.com/company/haveibeenpwned
- type: Website
  url: https://haveibeenpwned.com
- type: Documentation
  url: https://haveibeenpwned.com/API/v3
- type: Pricing
  url: https://haveibeenpwned.com/API/Key
- type: Signup
  url: https://haveibeenpwned.com/API/Key
- type: FAQ
  url: https://haveibeenpwned.com/FAQs
- type: Blog
  url: https://www.troyhunt.com
- type: Twitter
  url: https://twitter.com/haveibeenpwned
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com