# Have I Been Pwned

**Canonical:** https://apis.io/providers/have-i-been-pwned/  
**Website:** https://haveibeenpwned.com  
**APIs profiled:** 16

Have I Been Pwned (HIBP) is a free service operated by Troy Hunt that lets individuals and organizations check whether their email addresses, phone numbers, passwords, or domains have appeared in known data breaches, pastes, or stealer logs. The service aggregates billions of compromised records and exposes both free and paid endpoints, including the k-anonymity Pwned Passwords API. The v3 REST API at haveibeenpwned.com requires an hibp-api-key header for breach, paste, domain, and stealer log endpoints and is offered across Core, Pro, and High RPM subscription tiers.

## Kin Score — 52.8 / 100 (developing)

Scored 2026-08-21 under rubric 0.12.0. Trend: flat (+0.4 from 52.4).

| Facet | Score |
|---|---|
| Discoverability | 74.1 |
| Contract Quality | 60.4 |
| Governance | 28.8 |
| Contract Governance | 28.8 |
| Operational Transparency | 18.4 |
| Developer Ergonomics | 38.1 |
| Commercial Clarity | 84.2 |
| Access Clarity | 84.2 |

## Agent readiness — 44.9 (agent-ready)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | verified |
| OpenAPI Examples | verified |
| Rate Limit Signal | verified |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Self-serve signup — onboarding: self-serve, pricing: unknown, trial: no (confidence: medium).

## APIs (16)

- **Have I Been Pwned API v3** — REST API for searching breached accounts, pastes, breach metadata, domain breach data, and stealer log entries. Authentication requires an hibp-api-key header (32-character key)...
- **Pwned Passwords API** — Free, unauthenticated, k-anonymity-based API to check whether a password hash appears in the 800+ million record Pwned Passwords dataset. Clients submit the first five character...
- **Have I Been Pwned Breach API** — The Breach API from Have I Been Pwned — 1 operation(s) for breach.
- **Have I Been Pwned Breachedaccount API** — The Breachedaccount API from Have I Been Pwned — 2 operation(s) for breachedaccount.
- **Have I Been Pwned Breacheddomain API** — The Breacheddomain API from Have I Been Pwned — 1 operation(s) for breacheddomain.
- **Have I Been Pwned Breaches API** — The Breaches API from Have I Been Pwned — 1 operation(s) for breaches.
- **Have I Been Pwned Dataclasses API** — The Dataclasses API from Have I Been Pwned — 1 operation(s) for dataclasses.
- **Have I Been Pwned Domainverification API** — The Domainverification API from Have I Been Pwned — 3 operation(s) for domainverification.
- **Have I Been Pwned Latestbreach API** — The Latestbreach API from Have I Been Pwned — 1 operation(s) for latestbreach.
- **Have I Been Pwned Pasteaccount API** — The Pasteaccount API from Have I Been Pwned — 1 operation(s) for pasteaccount.
- **Have I Been Pwned Range API** — The Range API from Have I Been Pwned — 1 operation(s) for range.
- **Have I Been Pwned Stealerlogsbyemail API** — The Stealerlogsbyemail API from Have I Been Pwned — 1 operation(s) for stealerlogsbyemail.
- **Have I Been Pwned Stealerlogsbyemaildomain API** — The Stealerlogsbyemaildomain API from Have I Been Pwned — 1 operation(s) for stealerlogsbyemaildomain.
- **Have I Been Pwned Stealerlogsbywebsitedomain API** — The Stealerlogsbywebsitedomain API from Have I Been Pwned — 1 operation(s) for stealerlogsbywebsitedomain.
- **Have I Been Pwned Subscribeddomains API** — The Subscribeddomains API from Have I Been Pwned — 1 operation(s) for subscribeddomains.
- **Have I Been Pwned Subscription API** — The Subscription API from Have I Been Pwned — 1 operation(s) for subscription.

## Agentic access (1)

- **Have I Been Pwned Agentic Access** — 17 operations · 3 acting

## Security (3)

- **Have I Been Pwned Authentication** — apiKey · 1 scheme
- **Have I Been Pwned Domain Security** — TLSv1.3 · HSTS · DNSSEC · DMARC
- **Have I Been Pwned Vulnerability Disclosure** — security.txt · contact published

## Plans (1)

- **Have I Been Pwned Plans Pricing**

## Use cases (5)

- **Account Takeover Prevention** — Block sign-ups using credentials known to be in public breaches.
- **Incident Response Triage** — Quickly enumerate breaches and pastes touching an affected user.
- **Domain Risk Monitoring** — Continuously detect when a domain's users appear in new breaches.
- **Password Strength Enforcement** — Reject candidate passwords already present in the Pwned Passwords corpus.
- **Stealer Log Notification** — Detect infostealer-captured credentials before adversaries weaponize them.

## Tags

Security, Data Breaches, Pwned Passwords, Identity, Threat Intelligence, Credential Stuffing

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/have-i-been-pwned/). Scores are computed from the provider's own public artifacts under a published rubric.