What "Have I Been Pwned" Does
Have I Been Pwned is a free website where you enter your email address and learn whether it appeared in any publicly known data breaches. The site does not fix a compromised account or change your password — it only tells you whether your email was exposed and which breach it came from. You search once, get a yes or no answer, and then decide what to do next based on what you find.
The site is run by Troy Hunt, a security researcher who collects data from breaches that hackers have publicly released or sold. When a company gets hacked, the stolen data often ends up on the dark web or in public databases. Hunt gathers this information and makes it searchable so you can see if your email is in it. The database includes breaches going back years, so even old incidents show up.
Finding your email in a breach does not mean your account is currently compromised — it means your email address was exposed at some point in the past. What happens next depends on whether you still use that password anywhere and how recent the breach was.
Key Takeaways
- Have I Been Pwned searches only publicly known breaches, so a negative result does not mean your email is completely safe.
- The site tells you which company was breached and when, but not what information was stolen from you specifically.
- If your email shows up in a breach, change the password on that account when ready, especially if you use the same password elsewhere.
- You can set up notifications so the site emails you if your address appears in a future breach.
How to Search Your Email Address
Go to haveibeenpwned.com and type your email address into the search box on the home page. The site will search its database and return results in seconds. If your email appears in a breach, you will see a list of the breaches it was found in, along with the date each breach occurred and what type of data was exposed (passwords, usernames, phone numbers, and so on).
If the search returns no results, your email was not found in any of the breaches in the database. This is good news, but it does not mean you are completely safe — it only means your email was not in breaches that have been publicly released or that Hunt has collected. Private breaches that have not been made public will not show up.
The search is free and does not require you to create an account or provide any information beyond your email address. You can search as many email addresses as you want.
What the Results Mean
When a breach shows up in your results, the site tells you the name of the company, the date of the breach, and what categories of data were exposed. For example, you might see "LinkedIn — May 2021 — Email addresses, passwords, phone numbers." This tells you that your email and password were in that breach, but it does not tell you whether the password was encrypted, whether it has been cracked, or whether anyone is actively using it to break into your account.
Multiple breaches on your results mean your email was exposed in more than one incident. This increases the chance that someone has your email paired with a password, but it does not mean all your accounts are compromised — only the ones where you used a password that was exposed.
The site also shows you whether the breach included passwords, and if so, whether those passwords were hashed (scrambled) or stored in plain text. Plain text passwords are more dangerous because they can be used when ready. Hashed passwords are harder to crack but not impossible.
Setting Up Breach Notifications
Have I Been Pwned offers a notification service called Pwned Passwords that alerts you if your email appears in a future breach. To set this up, enter your email address and click "Notify me" on the results page. The site will send you an email asking you to confirm. Click the link in that email, and you will start receiving notifications if your address shows up in new breaches.
This service is optional and free. You can turn off notifications at any time by clicking the unsubscribe link in any notification email. The site does not sell your email address or use it for anything other than sending these alerts.
Notifications typically arrive within hours or days of a breach being added to the database, so you can respond quickly if your email appears in a new incident.
What to Do If Your Email Is in a Breach
The first step is to change the password on the breached account. If you use the same password on other accounts, change those passwords too — this is the most important action you can take. Hackers often try passwords from one breach on other popular sites, so reusing passwords across accounts puts all of them at risk.
If the breach included security questions or recovery information, update those as well. For example, if your mother's maiden name was exposed, change your security question answer if the site allows it.
Check the account's login history or activity log if the site offers one. Most email providers and social media sites show you where and when your account was accessed. If you see logins from places you do not recognize, change your password when ready and consider enabling two-factor authentication.
Enable two-factor authentication on the account if it is available. This adds a second step to logging in — usually a code sent to your phone or generated by an app — so even if someone has your password, they cannot get in without that code.
Limitations of Have I Been Pwned
The site searches only breaches that have been publicly released or that Hunt has obtained. If a company is hacked but keeps it quiet and does not release the data publicly, that breach will not be in the database. This means a negative result does not may provide your email is safe — it only means it was not in breaches that are publicly known.
The site also does not tell you what to do about a breach beyond showing you it happened. It does not contact the company on your behalf, file a report, or help you recover a compromised account. Those steps are your responsibility.
Have I Been Pwned is a one-time search tool. It shows you past breaches but does not monitor your accounts going forward. For ongoing protection, you need to use strong, unique passwords and enable two-factor authentication on important accounts.
Other Ways to Check for Breaches
Google offers a similar service called Google Password Checkup, which is built into Chrome and Google Account. If you use Chrome, the browser will warn you if a password you have saved has been exposed in a known breach. You can also check manually by going to myaccount.google.com, clicking "Security" in the left menu, and scrolling to "Your data on the web."
Many password managers, including Bitwarden and 1Password, include breach monitoring as a feature. If you use one of these tools, it will alert you if any of your saved passwords appear in a breach.
Your email provider may also notify you directly if your account was involved in a breach. Gmail, Outlook, and Yahoo all send alerts when they detect suspicious activity or when your password appears in a known breach.
Frequently Asked Questions
Is Have I Been Pwned safe to use?
Yes. The site does not store your email address or track you. It searches its database and returns results, but it does not save what you searched for or create an account. The only information the site keeps is what you voluntarily provide if you sign up for notifications.
What if I find my email in multiple breaches?
Change the password on that account and any other accounts where you use the same password. The more breaches your email appears in, the more likely someone has your password. Focus on changing passwords on important accounts like email, banking, and social media first.
Can I remove my email from Have I Been Pwned?
No, and you should not want to. The site is a record of what was exposed in real breaches. Removing your email from the site does not remove it from the breach itself — it only hides the information from you. It is better to know your email was exposed so you can take action.
Does Have I Been Pwned tell me if my password was cracked?
Not directly. The site shows you whether a password was hashed or stored in plain text, but it does not tell you whether someone has successfully cracked a hashed password. If your email appears in a breach with passwords, assume the password is compromised and change it regardless.
What should I do if my email is not in any breaches?
Keep using strong, unique passwords and enable two-factor authentication on important accounts. A clean result today does not mean your email will never be in a breach, so ongoing security habits matter more than a single search result.