What it does
Have I Been Pwned provides information about accounts exposed in known data breaches, with a public lookup resource and related monitoring offerings.
Have I Been Pwned checks whether an email address appears in breaches the service has recorded. Use a match to review the affected account and reused credentials; no match does not establish that an account was never exposed. Its policy says a normal search result is not explicitly stored, but operational web logs can include submitted form information and be retained up to 31 days. Notification enrollment stores the address and requires email verification. Sensitive breaches are excluded from public searches and require verified access. Choose an on-demand search or ongoing notification with those different disclosures in mind.
Strengths
- Known-breach exposure information for account review
Best for
- People prioritizing follow-up on their own account exposure
Sources
- Have I Been Pwned: Who, What & Why (Oct 26, 2026)
- Have I Been Pwned privacy policy (Oct 26, 2026)