Data Breach Checker — Email & Password via Have I Been Pwned

Check whether emails or passwords have appeared in known data breaches, in bulk. Data Breach Checker uses the official Have I Been Pwned (HIBP) APIs and returns which breaches, when they happened and what kinds of data were exposed. It returns metadata only, never leaked values.

• Password checks are free and need no API key. They use HIBP's k-anonymity range API: only the first 5 characters of the SHA-1 hash ever leave the run, never the password.
• Email checks use your own HIBP API key (hibpApiKey input or HIBP_API_KEY environment variable).
• Demo mode returns synthetic sample rows so you can see the output before you add a key.
• Every run ends with a batch summary row: how many emails were breached, how many passwords were compromised, and the most common exposed data types.

---

💡 Use cases

• Security and IT teams: audit staff or customer email lists for breach exposure and prioritise password resets.
• Password hygiene checks: test candidate or default passwords against known breach corpuses before allowing them.
• MSPs and consultants: produce breach-exposure reports for clients.
• Lead and CRM quality: flag emails that appear in breaches as real, long-used addresses.
• Fraud and trust teams: add breach history as one signal in account-risk reviews.

---

🔧 Inputs

Field	Notes
emails	Email addresses to check (needs an HIBP API key)
passwords	Passwords to check for free via k-anonymity (stored as a secret input)
hibpApiKey	Optional HIBP API key (secret); overrides the HIBP_API_KEY env var
includeUnverified	Include breaches HIBP marks as unverified (default on)
requestDelayMs	Delay between email checks to respect HIBP rate limits (default 1600 ms)
maxBreachesListed	Cap on breach details listed per email (default 100)
demoMode	Synthetic sample rows, no live HIBP calls

🚀 Quick start

{
  "emails": ["you@yourcompany.com"],
  "passwords": ["Summer2024!"],
  "hibpApiKey": "YOUR_HIBP_KEY"
}

Get a key at haveibeenpwned.com/API/Key. Password checks and demo mode work without one.

📤 Output

One row per email or password, plus one batch summary row per run.

{
  "type": "email",
  "email": "demo.user@example.com",
  "breached": true,
  "breachCount": 2,
  "mostRecentBreach": "2021-06-15",
  "dataClassesExposed": ["Email addresses", "Passwords", "Usernames"],
  "breaches": [
    { "name": "DemoBreachFixture2021", "domain": "example.com", "breachDate": "2021-06-15", "dataClasses": ["Email addresses", "Passwords"], "isVerified": true }
  ],
  "source": "hibp"
}

{
  "type": "password",
  "passwordSha1Prefix": "5BAA6",
  "compromised": true,
  "timesSeen": 52256179,
  "advice": "Compromised — seen 52,256,179 time(s) in known breach corpuses. Do NOT use this password."
}

(Values above are illustrative.) Download results as CSV, Excel or JSON from the Output tab, or pull them with the Apify API, webhooks, Zapier or Make.

---

❓ FAQ

How do I check if my email was in a data breach? Add the email to Emails to check, paste your HIBP API key, and run. Each email returns whether it was breached, the breach names and dates, and the types of data exposed.

Do I need an API key? Only for email checks, because Have I Been Pwned requires one for email lookups. Password checks and demo mode need no key.

Is it safe to check passwords here? Yes. The password is hashed with SHA-1 inside the run and only the first 5 characters of the hash are sent to HIBP (k-anonymity). The password itself never leaves the run and is never written to the dataset.

Does it show leaked passwords or personal data? No. It returns breach metadata only: breach names, dates, domains, counts and data types. It never returns leaked values.

How is it billed? Pay per event: a small start fee plus a fee per dataset row. See the Pricing tab on this page for the current per-event prices. You are only charged for the events listed there, and you can cap spend with the run's maximum charge setting.

Is this affiliated with Have I Been Pwned? No. It is an independent Actor that calls the official public HIBP APIs.

---

⚖️ Compliance

• Official, consent-based HIBP APIs only: no stolen credential dumps, no hash markets, no illegal data.
• Returns breach metadata only (never leaked passwords or personal values).
• Check only emails and passwords you have a legitimate reason to check.
• Not affiliated with Have I Been Pwned.

🔗 Related tools

Each result row includes a softCta object with next-step links to related IntelScrape Actors such as Email Finder, Contact Info Scraper, Google Maps Email Extractor, Watson Username Search, TruePeopleSearch Scraper and Skip Trace PRO. These are links only and add no extra charges.