Security & privacy tools / Have I Been Pwned
Have I Been Pwned
Have I Been Pwned (HIBP) is a data breach search and notification service used by security teams, developers, and MSPs worldwide.
Where it stands
3.8 / 5
Signals score
Not a hands-on test
Based on 2 of 3 signals
- Website health4.6 / 5 · weight 50%
Measured from the tool's public website
- Community3.2 / 5 · weight 20%
What people said in public discussions
Built only from what we can measure or quote without using the tool. How ranking works
Rank by signals
We have not run our own hands-on test on Have I Been Pwned yet. Facts checked 2026-11-08. How tests work
Disclosure: agathox makes some of the tools listed here. They are labelled and scored by the same method as every other tool.
Should you use Have I Been Pwned?
A quick read built only from what the tool's own pages state and from our tests, not from opinion. Facts checked 2026-11-08.
A good fit if…
- You want a free option. It states: “HIBP delivers a range of free and paid services to individuals and organisations anywhere in the world to help them determine if…”
Check first
- Its pages do not state: signup, watermark. Check on the tool's site before you rely on it.
Does: Data breach checker
Measured signals
4.6 / 5 · measured 2026-11-08Read automatically from Have I Been Pwned's public website: how reliable, secure, private and open the site is. This is not a test of how well the tool does its job. How this is measured
- Reliability5 / 5The page answered and finished downloading in 17 ms.
- Security5 / 55 of 5 protective headers set (strict-transport-security, content-security-policy, x-content-type-options, referrer-policy, x-frame-options).
- Privacy5 / 5No third-party tracking services found on the page.
- Transparency3 / 5Links a privacy policy; no pricing page linked.
Community feedback
3.2 / 5 · 34 commenters56% of the 34 people whose comments we could classify were positive. Read automatically from public Hacker News threads about Have I Been Pwned; the classifier is simple and can misread sarcasm, so check the threads. How this works
- Positive
“I knew I was, but I was delighted by what Dreamhost did: they have cross-checked their users' e-mails with the Adobe leaked database and sent a message [1] to affected users explaining the situation and advising to…”
Read in the thread - Positive
“But only a few have an email address connected. So it would be nice to have a service where you put in a phone number and it will list what information is available for it. Like this: [X] Phone Number [X] Name [X]…”
Read in the thread - Critical
“One thing that really keeps annoying me about HaveIBeenPwned is the fact that I can enter anyone's email and get their status immediately. This way I can anonymously check if that email had an account at a breached site…”
Read in the thread - Critical
“I have a couple of email addresses that thanks to that address either having been sold, hacked or given away by including in the to/cc field of a mass mailing are now out in the public domain, and I get spam (and almost…”
Read in the thread
Threads: Have I been pwned? Check if your email has been compromised in a data breach (2013, 283 comments) · HaveIBeenPwned adds yesterday's Facebook breach (2021, 173 comments) · Have I Been Pwned? Data breach master list with API (2016, 116 comments) · SoundCloud Data Breach Now on HaveIBeenPwned (2026, 110 comments)
- Free tier
- HIBP delivers a range of free and paid services to individuals and organisations anywhere in the world to help them determine if they have been impacted by a data breach. The page says: “HIBP delivers a range of free and paid services to individuals and organisations anywhere in the world to help them determine if they have been impacted by a data breach so they can effectively respond and protect themselves and the information.”
- Paid plan
- HIBP delivers a range of paid services to individuals and organisations. The page says: “HIBP delivers a range of free and paid services to individuals and organisations anywhere in the world to help them determine if they have been impacted by a data breach so they can effectively respond and protect themselves and the information.”
- Signup
- Not stated.
- Watermark
- Not stated.
- Where files go
- Superlative securely stores the personal information we hold in a Western United States of America Microsoft Azure data centre. The page says: “Superlative securely stores the personal information we hold in a Western United States of America Microsoft Azure data centre.”
From the tool's own pages, checked 2026-11-08. Sources: Privacy. Prices and limits change; check the tool before you rely on them.
Read automatically by a program, not by a person. Each fact quotes the sentence it came from, and a fact is shown only if that sentence is on the page. Where a page did not say, it reads “Not stated.”
Get an email if Have I Been Pwned changes
We check its official pages every week. If they change, we tell you, so you can see if the price or limits moved. No other email, and one click stops it.
Are you the maker of Have I Been Pwned? Link to this page
Copy this into your site. The link goes to this page, and it does not change any score.
<a href="https://agathox.com/tools/have-i-been-pwned">Have I Been Pwned on agathox: compared and tested</a>
Tasks and scores
- Data breach checkerNot tested yet
Similar tools
Top signals in Data breach checker.
Something wrong or out of date on this page? Tell us and we will fix it.