Have I Been Pwned API

haveibeenpwned.com · Security

Security API Key Paid Security Data Breaches Passwords

Check if email addresses, usernames, or passwords have appeared in known data breaches. 14+ billion compromised accounts indexed. Free read access; API key required for email/account checks.

Authentication

API Key authentication API key required for breaches/pastes endpoints ($3.50/month). Password range checking is free with no key. Pass key as hibp-api-key header.

Sample Requests

GET Check if password is pwned

Check if a password appears in breaches using k-anonymity (send first 5 chars of SHA-1 hash). "5BAA6" is the prefix for "password".

https://haveibeenpwned.com/api/v3/https:/api.pwnedpasswords.com/range/5BAA6

Hover any highlighted part to learn what it does

curl -X GET "https://haveibeenpwned.com/api/v3/https://api.pwnedpasswords.com/range/5BAA6"

import requests
response = requests.get(
    "https://haveibeenpwned.com/api/v3/https://api.pwnedpasswords.com/range/5BAA6",
)
print(response.json())

const url = 'https://haveibeenpwned.com/api/v3/https://api.pwnedpasswords.com/range/5BAA6';

const response = await fetch(url); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	targetURL := "https://haveibeenpwned.com/api/v3/https://api.pwnedpasswords.com/range/5BAA6"
	req, _ := http.NewRequest("GET", targetURL, nil)

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://haveibeenpwned.com/api/v3/https://api.pwnedpasswords.com/range/5BAA6")

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Get.new(uri)

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://haveibeenpwned.com/api/v3/https://api.pwnedpasswords.com/range/5BAA6";
$opts = ["http" => [
    "method" => "GET",
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

GET Get breaches for email

Check which breaches an email appeared in.

https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]

Hover any highlighted part to learn what it does

Headers — extra info sent with the request

hibp-api-key

YOUR_KEY

curl -X GET "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]" \
  -H "hibp-api-key: YOUR_KEY"

import requests
headers = {
    "hibp-api-key": "YOUR_KEY"
}
response = requests.get(
    "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]",
    headers=headers,
)
print(response.json())

const url = 'https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]';

const response = await fetch(url, {
  headers: {
    'hibp-api-key': 'YOUR_KEY'
  },
}); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	targetURL := "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]"
	req, _ := http.NewRequest("GET", targetURL, nil)
	req.Header.Set("hibp-api-key", "YOUR_KEY")

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]")

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Get.new(uri)
req["hibp-api-key"] = "YOUR_KEY"

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]";
$opts = ["http" => [
    "method" => "GET",
    "header" => implode("\r\n", [
        "hibp-api-key: YOUR_KEY"
    ]),
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

Postman Setup Guide

Get Postman ↗

Password check is FREE — no key needed
Hash your password with SHA-1, take first 5 chars, GET /range/{5chars}
Email check requires a paid key ($3.50/month) at haveibeenpwned.com/API/Key
Set header: hibp-api-key: YOUR_KEY

What can you build with Have I Been Pwned API?

Have I Been Pwned API is a Security API. Developers commonly use security APIs for:

adding multi-factor authentication to your app
validating identity documents and biometrics
monitoring for data breaches and leaked credentials
running background checks and fraud screening
scanning code and infrastructure for vulnerabilities

API Key authentication. You'll receive a key after signing up. Send it with every request — in a header or query parameter. Keep it out of client-side code and never commit it to version control. Have I Been Pwned API is a paid API — check the provider's pricing page before building a production integration.

New to APIs? Read our beginner's guide

Open documentation ↗