HaveIBeenPwned
Passwords which have previously been exposed in data breaches
- Authentication
- API Key
- HTTPS
- Yes
- CORS
- Unknown
- Category
- Security
- Data source
- public-apis + marcelscruz
- Documentation / URL
- https://haveibeenpwned.com/API/v3
Overview
HaveIBeenPwned provides breach data — the breaches endpoint works keyless (verified live); other endpoints need a key.
Quick Start
Breaches (verified live — 1.1MB):
curl "https://haveibeenpwned.com/api/v3/breaches"Authentication
- Register at haveibeenpwned.com → API key (for account endpoints).
- Send it as the
hibp-api-keyheader.
Rate Limits & Notes
- Free tier with limits (check the docs); paid plans scale.
- Breaches, passwords, accounts.
FAQ
Is HaveIBeenPwned free? Free tier with limits; more is paid.
Does it need a key? Breaches list works keyless (verified); account lookups need a key.
What does it return? Breach data.
More in Security
| API | Auth | HTTPS | CORS | |
|---|---|---|---|---|
| Application Environment Verification Android library and API to verify the safety of user devices, detect rooted devices and other risks | API Key | Yes | Yes | ↗ |
| ArkForge Trust Layer Cryptographic proof API for HTTP exchanges — Ed25519, RFC 3161, and Sigstore Rekor attestation | API Key | Yes | Unknown | ↗ |
| BinaryEdge Provide access to BinaryEdge 40fy scanning platform | API Key | Yes | Yes | ↗ |
| BitWarden Best open-source password manager | OAuth | Yes | Unknown | ↗ |
| Botd Botd is a browser library for JavaScript bot detection | API Key | Yes | Yes | ↗ |