Is Have I Been Pwned safe: logs, passwords and who runs it

What happens to the address you type

The FAQs on the Have I Been Pwned site, which we abbreviate to HIBP, say the public search cannot return anything other than the result for a single address or username at a time, so there is no list of everyone’s details to browse. Searching a whole domain is a separate feature, and the FAQs and the privacy policy both tie it to proving that you control the domain. The policy lists five ways to prove it: an address on the WHOIS record, a common mailbox such as security@, a meta tag, a file uploaded to the website, or a text entry in the DNS record. The FAQs also say that when a breach is loaded, no passwords are loaded with the addresses, and that HIBP does not send people their exposed passwords, because any ability to send them would put both the person and the operator at greater risk.

On logging, two HIBP pages speak in different terms. The FAQs say nothing is explicitly logged by the website, with Google Analytics, Application Insights performance monitoring and diagnostic data from an exception as the only logging of any kind, and in another answer that searches are not logged. The privacy policy, updated in May 2025, says HIBP does not collect or store your personal information when you search, and that a search only retrieves the data from storage and returns it in the response. The same policy says web server logs are kept for up to 31 days, and that these logs may include information submitted in a form, browser headers and, in some cases, the IP address. It also says HIBP uses no third-party cookies or tracking pixels and serves no ads, but that it does use its own cookie, which on its own does not disclose personal details and, once you sign in or give identifying information such as an email address, lets HIBP link that session back to you on later visits. SlashGear says the site does not even log search queries, and Malwarebytes, in 2021, quotes the FAQ sentence word for word.

The two HIBP pages differ on a visible point: the FAQs name Google Analytics, and the policy says it uses no third-party cookies or tracking pixels. The pages we read do not explain how the two fit together, do not say which describes the site today, and do not say how the policy’s sentence about forms in server logs relates to its sentence about searches.

On protection, the policy describes what it calls defence in depth: HTTPS for everything sent over the internet, Cloudflare used extensively to block malicious requests, rate limits on the APIs in the code and in Cloudflare, regular security scans, firewalls around the services running on Microsoft Azure, and a security.txt file for reporting vulnerabilities. One FAQ answer takes up the fear that the site is harvesting searched addresses. It says “You don’t” know, but that it is not, and adds that if you are concerned about the intent or security, you should not use it. Another answer covers the reader who searched and was later hacked: the FAQs call that a coincidence, say an address alone is not enough to get into an account, and say the password check is anonymised before it is sent, so searching for both does not yield a usable pair.

Who runs it, and a claim that has aged

The About page says Troy Hunt created the service and has run the website since 2013, as a free resource for anyone to quickly assess whether an online account of theirs has been put at risk in a data breach. It says the site came about after the Adobe breach, at the time the largest single breach of customer accounts, when Hunt kept finding the same accounts exposed over and over, often with the same passwords. The privacy policy says HIBP is owned and operated by Superlative Enterprises Pty Ltd, a business based in Queensland, Australia, and the About page says Have I Been Pwned is a registered trade mark of that company. The policy adds that the data is stored in a Microsoft Azure data centre in the western United States.

The size of the team is where the pages disagree because they were written years apart. Malwarebytes wrote in May 2021 that the service is handled and maintained by Hunt alone, not a team. The About page we read in October 2026 names three people: Hunt; Charlotte Hunt, described as chief of all operational things, who manages the day-to-day logistics from customer onboarding to legal and finances; and Stefán Jökull Sigurðsson, who joined part-time in 2023 to maintain the codebase and the cloud infrastructure. On that point the 2021 article has been overtaken by the service’s own page.

The reassurance in the articles rests on a record. Malwarebytes answers the question of legitimacy with a plain yes and points to the years the service has run, to work with governments, including the United Kingdom, Australia and Romania, which monitor their own government domains through their national cyber security bodies, and to a 2019 announcement that it describes in some detail. Hunt had planned to hand the service to a better-funded structure, a plan called Project Svalbard, and Malwarebytes reports that in March 2020 the sale was stopped and that Hunt wrote that the service would carry on independently. SlashGear calls the site reputable and secure and says it is widely recommended by security professionals.

Both articles repeat what HIBP says about itself. The pages we read do not include an independent audit of the site, and they give no current count of breaches or addresses; the only number from the early days is the 154 million addresses Hunt cited in a post of December 2013. SlashGear writes only of hundreds of known data breaches.

Pwned Passwords and the five-character check

Searching for an address and checking a password are two services. The FAQs say that no password is stored next to any personally identifiable data such as an address, and that every password is SHA-1 hashed. The privacy policy describes the check: the password is hashed on your side with SHA-1, only the first 5 characters of the hash are sent to HIBP, following the Cloudflare k-anonymity implementation, and HIBP never receives the original password or enough information to discover it. The Pwned Passwords page adds that the service returns a list of matching suffixes, that the full comparison happens on your side, and that you can watch the request in your browser’s developer tools. It calls the service free and open source and gives over 18 billion requests a month, delivered through Cloudflare.

On what a result means, the FAQs say that a password found in the service has previously appeared in a data breach, that HIBP stores nothing about who it belonged to, only that it was exposed and how many times it has been seen, and that such a password should no longer be used. The Pwned Passwords page says the same, and tells anyone who has used a found password anywhere to change it immediately. In the other direction, the page says a clean result does not necessarily mean a good password, merely that the password is not indexed on the site. It also says NIST guidelines recommend checking user passwords against previously breached datasets. The page carries a promotion for the password manager 1Password under its partners.

Notifications, sensitive breaches and opting out

Hunt wrote in December 2013, just under three weeks after launch, that notifications were the number one request and that the notification service was free. The post explains the verification email, which makes sure only the legitimate owner of an address is signed up, and the CAPTCHA, which stops the process from being automated. It also says there is no account in the traditional sense, because Hunt did not want to handle people’s passwords. The privacy policy of 2025 describes the same double opt-in: you enter an address and prove you control it through a unique link in a verification email. The FAQs say the service stores the address, the date of subscription and a random token for verification. They also say you cannot receive notifications for an address you do not have access to, that emails come from noreply@haveibeenpwned.com, and that emails come from noreply@haveibeenpwned.com. The privacy policy, not the FAQs, adds that every breach notification email carries an unsubscribe link in the footer.

Some breaches are not shown to everyone. The FAQs call a breach sensitive when someone’s presence in it may adversely affect them if others can find it, and list 90 at the time we read them, among them Adult FriendFinder and Ashley Madison. A sensitive breach is not returned in public searches. It can be seen by signing in to the dashboard, which means verifying that you can receive an email at the address, and the privacy policy adds that domain owners who prove they control the domain can also find sensitive breaches in a domain search; SlashGear describes the same arrangement. The FAQs list other kinds of entry too: retired breaches, of which there were 2, Ticketek and VTech; unverified and fabricated breaches; spam lists; malware data, such as the Emotet data given to HIBP by the United States FBI and the Dutch NHTCU in April 2021; and stealer logs, for which HIBP stores the domain names of the sites where the details were entered. To judge a new breach, the FAQs list five checks: whether the affected service acknowledged it publicly, whether the data was merely copied from elsewhere, whether its structure fits a breach, whether the attackers showed evidence of how they got in, and what track record they have.

The privacy policy describes an opt-out with three levels. The first removes your address from the public search only; it is still stored, and domain owners can still see it in a domain search. The second removes all current and future breaches from your address, which HIBP keeps alongside an instruction never to load future ones. The third removes the address entirely, with the warning that if a later breach includes it, the address becomes publicly searchable again.

If your address is listed, and if it is not

If the search lists a site you do not remember, the FAQs give the possible reasons: your data may have been acquired by another service, the service may have rebranded, or someone else may have signed you up. They also say that the record of a breach against an address is an immutable historic fact that does not change when you change the password, and that anyone who does not want a breach to appear publicly against the address should use the opt-out. If the address is not found, the FAQs say HIBP holds only a small subset of all the records that have been breached, that many breaches never result in a public release and that many go undetected. The privacy policy repeats that its information does not represent all leaked information.

On what to do after a hit, the HIBP pages we read are brief and Malwarebytes is more specific. It says to change the password and make it longer, that length is enough according to a 2021 NIST guideline, and that a password manager can help, then to add two-factor authentication, preferably a one-time password app or, better still, a hardware key such as a Yubikey. The Pwned Passwords page names password reuse as the common risk and describes credential stuffing as attackers automating login attempts with leaked details; our page on credential stuffing covers that attack, and our page on what to close first after a data breach sets the order.

What we did not use

We ran no search on the service and sent it no address or password. We did not read any Reddit thread, user reviews such as those on Trustpilot, or guides published by security companies, and the Stack Exchange question on the topic could not be read, because its page returned only three words of text. On HIBP’s own site we read the About, FAQs, Privacy Policy and Pwned Passwords pages, and we did not read the pricing text, the API documentation or the terms of use, so this page says nothing about what the paid parts cost. The articles by Malwarebytes and SlashGear and Hunt’s 2013 post are dated, and where they differ from HIBP’s current pages we have said so.