Have I Been Pwned

What Have I Been Pwned does

Have I Been Pwned (HIBP) is a free, consumer-facing breach notification service founded by Troy Hunt in 2013 and operated by Superlative Enterprises Pty Ltd, an Australian private company headquartered in Queensland. HIBP aggregates data from 1,014+ breached websites containing 17.67 billion+ pwned accounts and lets any user check whether an email address or password has appeared in a known breach, with optional free email alerts via the Notify Me service. The underlying platform runs on Microsoft Azure (Azure Table Storage) for the breach corpus and on Cloudflare's 335-edge-location CDN for the Pwned Passwords API, which serves 18 billion+ monthly requests at a >99.9% cache hit ratio using a SHA-1 / NTLM k-anonymity model that never exposes full hashes or email addresses to the server.

The paid product surface is API-first, offered in tiered subscriptions (Core from $4.39/month to $319/month, Pro from $379/month to $4,599/month, High RPM from $1,150/month to $5,833/month, plus custom Enterprise with white-label and callbacks). Paid tiers unlock domain monitoring, bulk enrollment for MSPs, k-anonymity email search, and stealer-log access. Breach data is sourced from direct submissions, open-source scraping, and law-enforcement feeds including the FBI and the Dutch National High Tech Crime Unit, giving HIBP visibility into credential exposure that competitors cannot easily reproduce.

Distribution is predominantly product-led: the free email and password search drives top-of-funnel awareness, the API and developer documentation (including a 2025-launched Model Context Protocol server) carry mid-funnel conversion, and partner integrations with 1Password and Aura provide post-breach upsells for US users. Headcount is small (1-10, with founder Troy Hunt, his wife Charlotte Hunt on operations, and Microsoft MVP Stefán Jökull Sigurðsson part-time on engineering), and the company is bootstrapped with no disclosed external funding.

Name

Have I Been Pwned

Legal name

Superlative Enterprises Pty Ltd

Website

https://haveibeenpwned.com

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

1–10 employees

Short description

Have I Been Pwned is a free breach-notification service operated by Superlative Enterprises Pty Ltd that aggregates 1,014+ breached websites and 17.67 billion+ pwned accounts, letting individuals and organizations check exposed credentials via paid API subscriptions.

Ownership category

akta.pro rank

Product category

Breach Detection and Credential Monitoring

NAICS

Web Search Portals, Libraries, Archives, and Other Information Services (519)

akta.pro primary industry

Fraud Detection & Prevention (payments fraud, account takeover, scams) (FSAGAFAE)

Keywords

• Data breach monitoring
• Credential exposure checking
• Password security verification
• Breach notification service
• Domain breach monitoring

Headquarters

HQ city

Surfers Paradise

HQ country

Australia

HQ region

Oceania

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Software

Cost components

Technology or R&D, Infrastructure, Personnel, Operations

Revenue model

1. Free Email Search: Free point-in-time search for email addresses in breach database. Drives user acquisition and awareness.
2. Core Subscription: Direct email search via API with rate limits up to 1,000 RPM, monitoring for up to 20 domains. Pricing from $4.39 to $319/month billed annually.
3. Pro Subscription: Includes k-anonymity email search, customer domain monitoring for MSPs, bulk domain enrollment, auto subdomain verification, stealer log data. Rate limits up to 16,000 RPM, monitoring for up to 800 domains. From $379/month.
4. High RPM Subscription: High-throughput API access up to 24,000 RPM for fast email searches. Supports both direct and k-anonymity search. From $1,150/month.
5. Enterprise Subscription: White-label deployment, real-time breach callbacks, no API rate limits, invoiced billing, custom documentation, dedicated support. Custom pricing.
6. Pwned Passwords API (Free): Freely accessible password checking API with no subscription required. No licensing or attribution requirements.
7. Domain Search Subscriptions: Tiered pricing based on number of breached email addresses on domain and total domains monitored. Multi-year billing discounts available.

Pricing tiers

Go-to-market motion4 records

Distribution channels5 records

Marketing channels8 records

Core offering

Have I Been Pwned (HIBP) operates a searchable database of more than 17.6 billion compromised records aggregated from over 1,014 breaches. Its free consumer offering allows individuals to check whether their email or password has appeared in a known data breach, plus opt-in email notifications when future exposures occur. Its commercial offering is a paid RESTful API (with Core, Pro, High RPM, and Enterprise tiers) used by organizations, developers, and MSPs to programmatically search breach data, monitor corporate domains, and access stealer-log intelligence.

Product overview

Have I Been Pwned is a free public service that aggregates data breaches to help users check if their email addresses or passwords have been compromised. The core offering includes the main HIBP breach search, Pwned Passwords (free password checking via k-anonymity API), and the Notify Me notification service. Paid tiers (Core, Pro, High RPM) provide API access with rate limits ranging from 10 to 24,000 RPM, domain monitoring, stealer log search, and k-anonymity features. The Pro tier includes customer domain monitoring for MSPs, while High RPM focuses on high-volume email searches. An MCP Server enables AI agent integration. All data is served via Cloudflare's global network.

Differentiator

Problem solved

Functional benefit

Products and services

• Have I Been Pwned (Free Email Search)
• Pwned Passwords
• Notify Me

Quantifiable outcome

• 17,674,817,406 pwned accounts tracked
• +4 more outcomes

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Feature7 records

Partnerships

Five partnerships are on record, tiered flagship and core.

• AuraflagshipGTM or Marketing Partner · 16 July 2025Aura, a US-based identity protection service, was added to HIBP's partner program. Aura appears in HIBP dashboards and breach pages for US users, citing identity theft risks following data breaches as the driving rationale. Partnership provides Aura with a dedicated HIBP landing page featuring a discount.
• CloudflarecoreTechnology or IntegrationCloudflare provides the global infrastructure for serving HIBP's Pwned Passwords service, handling over 18 billion monthly requests through 335 edge locations across 125+ countries. The partnership enables >99.9% cache hit ratio and lightning-fast responses regardless of user location.
• 1PasswordflagshipGTM or Marketing Partner1Password appears in HIBP dashboards and breach pages for US users, offering post-breach protection services. Partnership provides HIBP with a dedicated landing page featuring a discount. 1Password is positioned as a partner offering post-breach protection services to HIBP users.
• US Federal Bureau of Investigation (FBI)flagshipStrategic or Co-development PartnerFBI provided HIBP with data from the Emotet malware campaign in April 2021, contributing to the malware breach data in the database. This law enforcement partnership helps expand HIBP's coverage of credential exposure.
• Dutch National High Tech Crime Unit (NHTCU)flagshipStrategic or Co-development PartnerDutch NHTCU provided HIBP with data from malware campaigns, contributing to the database's malware breach coverage alongside FBI data.

Scale indicators8 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• SpyCloud: SaaS credential-exposure intelligence platform that recaptures breached and stealer-log credentials for enterprise security teams. Closest direct competitor to HIBP's paid API and stealer-log products, with comparable data depth but a much larger sales footprint and Series-D funding.
• DeHashed: Searchable breach-data engine offering email, password, IP, and credential lookups via API to enterprise customers. Directly competes with HIBP's paid API tiers and domain-search functionality, serving similar corporate fraud-investigation and threat-intelligence buyers.
• Constella Intelligence: Identity-breach intelligence platform aggregating stolen credentials, exposed PII, and infostealer logs for fraud, AML, and security teams. Overlaps with HIBP's stealer-log and domain-search offerings, but at an enterprise tier with significantly more capital and headcount.
• LeakCheck: Paid breach-credential search service offering email, username, and password lookups via API. Closely comparable to HIBP's free and Core-tier offerings, though typically with a more raw-data approach and less emphasis on privacy-preserving k-anonymity.
• Snusbase: Breach-database search engine marketed to security researchers and fraud investigators with API and bulk-search access. Comparable to HIBP's API in functional capability, though Snusbase typically serves a more underground researcher segment.

Broad incumbents

• IntSights (Rapid7 Threat Command): Enterprise digital-risk-protection platform from Rapid7 that monitors surface, deep, and dark web for leaked credentials and brand threats. Overlaps with HIBP's domain and stealer-log monitoring at the enterprise end, but bundled into a much broader threat-intelligence suite.
• Recorded Future: Large-scale threat-intelligence platform (acquired by Mastercard for $2.6B) that ingests breach data, stealer logs, and credential leaks as part of a broader intelligence feed. Adjacent competitor to HIBP in credential-intelligence use cases, but operates at much greater scale and breadth.
• Mozilla Monitor: Consumer breach-notification service from Mozilla built directly on top of HIBP's API. Comparable end-user product for individuals but is a downstream consumer of HIBP rather than a competitor; demonstrates HIBP's role as upstream infrastructure for major browser vendors.

Emerging players

• 1Password Watchtower: Password-manager breach-alert feature (and HIBP GTM partner) that surfaces compromised-credential alerts to end users. Partly competes with HIBP's free email-check surface but is also a major distribution channel for HIBP breach data inside the 1Password product.

Others

• Aura: US consumer identity-theft-protection service and HIBP GTM partner that surfaces breach alerts in HIBP dashboards for US users. Not a direct data competitor, but a paid upgrade destination and distribution partner monetizing HIBP's breach-awareness traffic.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/HaveIBeenPwned
• LinkedInlinkedin.com/company/haveibeenpwned
• Xx.com/haveibeenpwned
• Facebookfacebook.com/haveibeenpwned

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Have I Been Pwned