Is Have I Been Pwned Safe? How Password Checks Stay Private

Is Have I Been Pwned safe? Yes. The real site, haveibeenpwned.com, is free and widely trusted. Its password check never receives your password, only the first five characters of a scrambled code made from it. The main risk is look-alike scam sites, so always type the address yourself.

What Have I Been Pwned is

Have I Been Pwned is a free website created in 2013 by Australian security researcher Troy Hunt. When customer data from a hacked company leaks online, the site adds the affected email addresses to a searchable database. It now covers hundreds of breaches and billions of accounts.

"Pwned" is gamer slang for being hacked or taken over.

Is Have I Been Pwned safe to use?

The real site is. Here's why:

• It's free and needs no account. Checking your email address or a password costs nothing.
• The email search never asks for a password. The site also doesn't store leaked passwords next to email addresses, so a search can't reveal an old password.
• Law enforcement works with it. The FBI has contributed leaked passwords from its investigations to the site's password list.

The main tradeoff is that anyone can search any email address, so a stranger could see that yours was in a breach. Sensitive breaches, such as those from adult sites, are hidden from public searches, and you can opt out of public searches altogether.

Email search vs password check

Have I Been Pwned has two separate tools, and people often mix them up.

The email search

Type in your email address, and the site lists the known breaches that included it, when each happened, and what was exposed, such as passwords, phone numbers, or home addresses.

An empty result is good news, but not a guarantee. The site only knows about breaches that have surfaced and been added to its database.

You can also sign up for free alerts about future breaches. The site sends a link to that inbox to confirm the address is yours.

The password check (Pwned Passwords)

Pwned Passwords is the tool for checking if your password has been leaked. It tells you whether that exact password has appeared in a breach, and how many times, without linking it to you or any email address.

A match means criminals have that password on their lists. They try leaked passwords first because so many people reuse them, so a leaked password isn't safe to keep, however long or complicated it is.

A match doesn't always mean your account was hacked, since someone else may have used the same password. And no match doesn't make a password strong. A short password can still be guessed, and a reused one could leak tomorrow.

How k-anonymity keeps your password private

It's fair to wonder whether it's safe to check your password online at all. If you type a password into a website, haven't you just handed it over?

The real site avoids that with k-anonymity, which means asking your question while hiding in a crowd. Here's what happens when you check a password:

1. Your browser scrambles the password into a hash. A hash is a code made from the password. The same password always makes the same hash, but a hash can't be run backwards to reveal the password.
2. Only the first five characters are sent. If your password were password, for example, the service would receive just 5BAA6.
3. The service sends back a list. It returns every leaked hash that starts with those same five characters, usually hundreds of them.
4. Your browser checks the list privately. The comparison happens on your own device. If your full hash is on the list, that password has leaked.

The service never sees your password or even its full hash. Countless possible passwords share those first five characters, so it can't tell which one you checked or whether you found a match. That crowd is what keeps a k-anonymity password check private.

An everyday analogy

Imagine you want to know whether a library has a certain book, without the librarian learning which book you mean.

So you ask for every book whose catalog number starts with 5BAA6. The librarian wheels out a cart of hundreds of books, and you look through it at a private table.

The librarian knows which section you asked about, but not which book you wanted or whether it was there. In the real check, the catalog number is your password's hash, the cart is the list the service sends back, and the private table is your own browser.

How to avoid fake breach-check sites

Because Have I Been Pwned is a trusted name, scammers copy it. The privacy protections above only exist on the real site. A fake can look identical and send whatever you type straight to a scammer.

These habits keep you safe:

• Type the address yourself. Don't follow links in texts, ads, pop-ups, or unexpected emails.
• Check the address bar. Look for misspellings, extra words, or an ending other than .com.
• Know what the real email search asks for. It needs only your email address. A site that asks for your email password to "check your account" is a scam.
• Ignore pressure. Warnings like "Your accounts are being hacked right now!" are a scare tactic. A real breach result is just information.
• Never install software or call a number to "fix" a result. Nothing needs to be downloaded, and no legitimate checker needs remote access to your computer.

If you already typed a password into a site you now doubt, change it right away. Then follow what to do if you gave a scammer your password.

Password managers that check for you

Even when you use the real site, a good rule is to type passwords you currently use only on the sites they belong to. Many password managers can do the checking for you. Their built-in health check flags saved passwords that are weak, reused, or known to have leaked.

Pinzen's password health check works this way. Its exposure check uses the same Have I Been Pwned k-anonymity method described above, so only five characters of a hash leave your browser. The health check is included on the free plan, and you can read how Pinzen encrypts your vault before storing it.

Your phone may do something similar. If your iPhone or Google account has warned you about a "compromised" password, here's what a compromised password warning means.

What to do if your email or password shows up

First, don't panic. A result means your details were exposed somewhere, not that someone is in your account right now. Work through these steps:

1. Change the affected password. If your email showed up, check whether passwords were exposed in that breach. If they were, change your password for that site. If a password matched, stop using it.
2. Replace it everywhere you reused it. Start with your email account, since it can reset your other accounts. Then move on to banking and shopping.
3. Make each new password unique and long. A password generator or four random words work well. Don't just add a number to the old one.
4. Add stronger sign-in protection. Turn on two-step verification, which adds a second check, such as a code from an authenticator app. If a site offers passkeys (sign-ins with your face, fingerprint, or screen lock instead of a password), use them.
5. Look for signs of misuse. Check recent sign-ins, email forwarding rules, and purchases you don't recognize.
6. Watch for follow-up scams. Scammers often send phishing emails to breached addresses. These are fake messages that pretend to come from a company you trust, and some mention the breach to seem believable.

For a full family checklist, see what to do after a data breach. If it was your email that turned up, read what it means when your email is in a data breach.

If replacing a stack of passwords sounds exhausting, a password manager can take over the remembering. You can create a free Pinzen vault, import saved logins from a CSV file (a simple spreadsheet export), and let the health check show which to replace first. The free plan works on one trusted device at a time. Syncing across devices is a paid upgrade.

Frequently asked questions

Is Have I Been Pwned legit?

Yes. It's a free service created in 2013 by security researcher Troy Hunt, and journalists, security teams, and password managers rely on its data. The FBI has even contributed passwords to it. The real risk is copycat sites, so type haveibeenpwned.com yourself instead of following links.

Is it safe to enter my password on Have I Been Pwned?

On the real site, yes. The password check is built so your password is never sent. Your browser scrambles it, sends only the first five characters of the result, and checks for matches on your own device. Still, it's safest to type a password you currently use only on the site it belongs to. A password manager's health check can scan your saved passwords for you.

What does pwned mean?

"Pwned" is internet slang for "owned," meaning beaten, taken over, or compromised. It's usually pronounced "poned." It likely began as a typo among online gamers, since P sits next to O on the keyboard. On Have I Been Pwned, it means your email address or a password turned up in a data breach.

What should I do if my password has been pwned?

Stop using it. Change it on every account that uses it, starting with email and banking, and make each new password unique. Turn on two-step verification where offered, and check recent account activity. A match means attackers know that password, not necessarily that anyone has signed in to your account.