Contents
An average data breach exposes between 1 and 100 million records within hours. Adobe in 2013, LinkedIn in 2012 (revealed in 2016), Yahoo in 2014 (revealed in 2016), Collection #1 in 2019, several million scraped Facebook IDs in 2021. With each episode, hundreds of millions of email addresses end up freely circulating on forums and the dark web.
The service Have I Been Pwned (HIBP, created in 2013 by security researcher Troy Hunt) aggregates these publicly verified breaches into a single searchable database. You type in your email, you immediately get the list of breaches your address appears in, with the exact nature of the exposed data (password, phone number, postal address, etc.).
This guide explains step by step how to use HIBP, how to read the results without panicking or minimising, and most importantly what concrete actions to take in the hours following a discovery of compromise.
Context
Understanding data breaches
A data breach happens when a database containing user information is extracted from a service by an attacker, then published or sold. Typical cause: a misconfigured server, a compromised admin account, or an unpatched software vulnerability.
Once the database is out, two paths are possible. The content is sold on a specialised forum to buyers who use it for credential stuffing (trying email/password pairs on other services). Or the content eventually gets posted publicly, and HIBP indexes it after verification.
Three types of data dominate in recent breaches:
- Credentials: email address + password (often hashed, sometimes plaintext in older breaches).
- Contact data: first name, last name, phone, postal address, date of birth.
- Behavioural metadata: IP address, login timestamps, purchase history.
Step by step
How to use Have I Been Pwned
The tool fits on a single page. The lookup is anonymous and requires no account.
Go to haveibeenpwned.com. Beware of imitations: only this domain is legitimate. Services that ask for payment for the same information should be avoided.
Type the email address you want to check in the single field in the centre of the page. HIBP also accepts phone numbers in international format (with country code) since the integration of the 2021 Facebook breach.
Click pwned?. The answer arrives in under a second. No cookie is set, no email address is logged by the service.
If your address is compromised, the page shows the list of every breach where it appears. Each breach shows the affected service, the date of the breach, the date of integration into HIBP, and the exact list of exposed fields (email, password, name, etc.).
At the bottom of the page, the Notify Me option signs you up for automatic alerts. Whenever a new breach containing your address is added to HIBP, you receive an email. More effective than manual checking.
Reading results
Interpreting what you see
HIBP signals two visual states without ambiguity. If your address isn't in the database, the page turns green with the message Good news, no pwnage found!. If it appears in at least one breach, the page turns red with Oh no, pwned!, followed by the detailed list.
Under a red result, each breach is listed as an independent card. The typical contents of a card:
An old breach is still serious
A 2014 breach isn't harmless in 2026. If you still use the same password as in 2014 (or an obvious variant), attackers can still leverage it in credential stuffing attacks. Breach date tells you its age, not its innocuousness.
Pwned Passwords
Checking a specific password
HIBP also offers a distinct tool, Pwned Passwords, that lets you test whether a specific password appears in the database of exposed hashes (over 850 million unique hashes). Useful before reusing a password or to audit an existing password vault.
The technical subtlety is that you never transmit your entire password to the server. HIBP uses a technique called k-anonymity: your browser calculates the local SHA-1 hash of the password, sends only the first 5 characters of the hash to the server, and receives back the list of matching hashes. The final comparison happens in your browser. HIBP's server never knows which password you tested.
Immediate action
What to do if you're pwned
Discovering your address is in a breach is unpleasant but not catastrophic. The sequence to follow is clear and fits in four acts.
Within the hour of the discovery
- Change the password on the affected service. Go directly to the site named in the breach, sign in, and change the password.
- Change the password everywhere you reused it. This is the most dangerous scenario. A password reused on 8 services turns into 8 simultaneous breaches.
- Enable 2FA (two-factor authentication). On the affected service first, then on all critical accounts: main email, bank, vendor portals.
- Check active sessions. Most major services (Gmail, Facebook, banks) let you see and disconnect ongoing sessions. Any unknown device should be disconnected.
In the days that follow
- Monitor bank statements for any unusual purchases, especially if the breach included financial information.
- Enable anti-phishing filtering on your inbox: exposed addresses are automatically added to target lists used in phishing campaigns.
- Contact the responsible service if you believe you've suffered harm (identity theft, fraud). In Europe, GDPR gives data subjects a right to information about the nature and scope of the breach.
- Consider reporting to the ICO (UK), CNIL (France), or your country's data protection authority if the breach has serious impact.
If the breach included your password in plaintext
Consider that password burned for life. Never reuse it. And look sceptically at passwords built by variation around it (my-pass-2024 → my-pass-2025). Attackers automate these variations in brute force attacks.
Prevention
Preventing the next leak
You can't stop a service you use from getting breached. You can reduce the impact of a future compromise with simple hygiene.
The six basic reflexes
- One unique password per service. When service X falls, service Y stays intact. The most powerful and least respected defence.
- A password manager. 1Password, Bitwarden, KeePassXC. The vault generates and stores complex passwords you don't have to remember. Without a manager, the "one password per service" reflex is impossible to maintain.
- 2FA on all critical accounts. Main email, bank, password manager, professional platform. Prefer authenticator apps (Aegis, 2FAS, Authy) over SMS, which is vulnerable to SIM swapping.
- Secondary emails for risky signups. Forums, betting sites, trial services. A "throwaway" email limits the spread of your main address.
- HIBP's Notify Me alert enabled on all your addresses. You'll know immediately when a new breach concerns you.
- Regular software updates. Most intrusions go through already-patched vulnerabilities that users haven't applied.
On the professional side
If you run an online business (training, coaching, course sales), your infrastructure's cybersecurity also protects your clients. Pick vendors that host your data in a protective jurisdiction, sign emails by default (SPF/DKIM/DMARC), and encrypt data at rest. That's the default approach at Heatcord for coaches running their webinars from Europe.
FAQ
Common questions
Is Have I Been Pwned reliable and safe?
What does "pwned" mean exactly?
What data does HIBP index?
What should I do immediately if I'm pwned?
How often should I check?
Are my professional accounts protected differently?
Conclusion
Have I Been Pwned doesn't fix any breach. It informs you that you're affected, which is already a lot. The real defence line is daily hygiene: one unique password per service, a manager to remember them, 2FA enabled on critical accounts, and Notify Me as passive monitoring. With these four reflexes, you turn every future breach into a personal non-event: your compromised password only opens one door, you change it, you move on.