What Is Have I Been Pwned, and How Do I Use It?
Have I Been Pwned is a breach-information service that can check an email address against collected records. Use its official site and interpret the result as a match within its datasets, not a complete verdict about account safety. Password checking is a separate function; the ordinary address search is not a request for your current password.
A careful personal lookup
Open the official service
Use haveibeenpwned.com directly rather than an unexpected warning’s login or payment link.
Check your identifier
Follow the current interface for an address you own or are authorized to investigate. Do not infer every feature from an old walkthrough.
Read the record context
Review the breach description and exposed data types instead of assuming every result includes a current usable password.
Act through the affected service
Use its actual account controls, address password reuse and strengthen authentication where supported.
Keep the check from becoming another disclosure
Verify the domain
A copied breach-warning page can ask for information the real lookup does not need.
Separate the functions
Read the distinction between address lookup and password checking before entering sensitive data.
Use authorized scope
A business-domain query has verification requirements; curiosity is not authorization to retrieve someone else’s exposure details.
An address lookup and a password check are different
HIBP’s FAQ separates the email-address lookup from Pwned Passwords. It explains that corresponding passwords are not loaded into the ordinary address search. Do not enter a current secret into an unrelated page pretending to be a breach notification.
A match can identify an exposure history without proving someone signed into the account. A negative result means no match in the covered data under that query, not that every possible source has been checked.
Interpret the result narrowly
| Subject | What it can mean | What it does not prove |
|---|---|---|
| A breach match | The identifier appears in collected breach information | A current account takeover |
| No match | No relevant result within the covered query | No exposure exists anywhere |
| A stealer-related finding | A documented additional record type | The exact device without supporting fields |
| Business-domain coverage | Authorized scope under the service’s rules | Permission to query arbitrary organizations |
An old breach can still prompt a useful check
Imagine an address appears in a historical record after the password was already replaced. You can confirm reuse was addressed and review recovery settings without assuming the account was compromised again today.
Use the age and data types to choose a proportionate response, not to dismiss or dramatize every match.
Questions people ask
Sources
Further reading
Glossary
Terms in this guide
Continue learning