Have I Been Pwned
Breach notification service in Privacy & security
Checks whether your email or passwords appeared in known breaches, with free domain-wide search. Critics say it reports exposure without a clear way to act.
Checks whether your email or passwords appeared in known breaches, with free domain-wide search. Critics say it reports exposure without a clear way to act.
55 people gave an opinion
- recommend it
- 29
- criticize it
- 26
- approval share
- 53%
Recommended in 6 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 29 people recommend itNeeds 10 or more, met.
- 1.1 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Privacy-conscious design limits data shared
“It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset.”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” “they are not storing more info along the email address, because that would be way too risky”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “Only the first 5 characters of a SHA-1 hash go to HIBP”
Comment from 16 Oct 2026 in “I never authorized an integration that scans my secrets” - Comment from 6 Nov 2025 in “Two billion email addresses were exposed”
Free domain-wide breach alerts
“they give me a list of every address @my-domain that’s been leaked”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “I get notified if any email of our family domain get leaked”
Comment from 8 Jun 2026 in “1k Data Breaches Later, the Disclosure Lag Is Worse” “HIBP has a domain-wide search feature which is free”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” Long-standing, careful, trusted operator
“HIBP is a very, very well established site with a long history of operating in good faith.”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “they tend to be pretty careful when checking the veracity of claims”
Comment from 8 Feb 2026 in “Why there is no official statement from Substack about the data leak” “he's been a leader in this space and walking the walk for a decade.”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” Tells you when accounts leaked
“Have I been pwned will tell me if the associated password for that site leaked.”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” “That's literally what Have I Been Pwned is for.”
Comment from 8 Jun 2026 in “1k Data Breaches Later, the Disclosure Lag Is Worse”
What people warn about
Each mark is one comment
Says you're exposed, not what to do
“HIBP is an invaluable service, but, on the other, it does nothing more than stating you’re in trouble, with no clear way forward.”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “the site does not give me any way to take action”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” “haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” - Comment from 7 Nov 2025 in “Two billion email addresses were exposed”
Paywalled features cost money
“I don't think it's cool to unilaterally privatize the service and turn it into a commercial one.”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” “For me, with a similar wildcard setup, it became something I wasn't willing to spend money on.”
Comment from 8 Jun 2026 in “1k Data Breaches Later, the Disclosure Lag Is Worse” “The problem is the cost of haveibeenpwned is too much for me as an individual.”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” - Comment from 6 Nov 2025 in “Two billion email addresses were exposed”
- Comment from 6 Nov 2025 in “Two billion email addresses were exposed”
Misses some leaks and needs exact emails
“I know for a fact that a certain email of mine have been exposed, but it never appears on the site.”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “can only find "exact email" addressed, as in, you must search for myname@gmail.com”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “you can't enter your email and find leaked passwords associated with the address”
Comment from 16 Dec 2025 in “We are discontinuing the dark web report” - Comment from 7 Nov 2025 in “Two billion email addresses were exposed”
Privacy worries about searched data
“the risk of typing my passwords into his website”
Comment from 6 Nov 2025 in “Two billion email addresses were exposed” “this tool inadvertently exposes users's full web history, including sensitive sites”
Comment from 27 Jan 2026 in “SoundCloud Data Breach Now on HaveIBeenPwned”
What people said
40 of the 64 comments that mention it, newest first. Each links to the original comment.
“The papers written about HIBP, one of which I contributed to, address some actual problems.”
“integrating with HIBP is actually the correct thing to do”
“the latter is basically just an argument against the HIBP service”
“If you've acquired leaked passwords as HIBP have, you then just make hash lookup tables”
“Only the first 5 characters of a SHA-1 hash go to HIBP”
“I do like the idea behind Have I Been Pwned”
“Thank you for the great free service.”
“the pricing cliff was pretty steep if I recall correctly”
“He provides an easy-to-use service for free.”
“For me, with a similar wildcard setup, it became something I wasn't willing to spend money on.”
“I get notified if any email of our family domain get leaked”
“That's literally what Have I Been Pwned is for.”
“they tend to be pretty careful when checking the veracity of claims”
“those concerned can check there if they don't want to seek the leak out on their own”
“this tool inadvertently exposes users's full web history, including sensitive sites”
“you can't enter your email and find leaked passwords associated with the address”
“HIBP has more data in my experience”
“the dashboard can provide you information about stealer logs for free”
“Doesn't help. Some accounts are old and may not be in my current PW DB.”
“HIBP is a very, very well established site with a long history of operating in good faith.”
“Then you'll know the security state of all of your passwords.”
“can only find "exact email" addressed, as in, you must search for myname@gmail.com”
“they are not storing more info along the email address, because that would be way too risky”
“This doesn't help. If the email address check says the address has been exposed it doesn't tell you which password”
“HIBP has raised awareness on having unique passwords per site.”
“I know for a fact that a certain email of mine have been exposed, but it never appears on the site.”
“they give me a list of every address @my-domain that’s been leaked”
“HIBP is an invaluable service, but, on the other, it does nothing more than stating you’re in trouble, with no clear way forward.”
“The problem is the cost of haveibeenpwned is too much for me as an individual.”
“the service requires that either you pay up or you have to guess and check”
“the risk of typing my passwords into his website”
“It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset.”
“HIBP has a domain-wide search feature which is free”
“he's been a leader in this space and walking the walk for a decade.”
“I don't think it's cool to unilaterally privatize the service and turn it into a commercial one.”
“it does not send your password to the server”
“haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords”
“the site does not give me any way to take action”
“Have I been pwned will tell me if the associated password for that site leaked.”
“they want to charge me a monthly fee to see which of those have been pwned”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.