| Guide | GDE-050 |
| Topic | Have I Been Pwned for OSINT |
| Domain | Breach and credential exposure |
| Last updated | September 2026 |
Short answer: Run the address through the free HIBP web search, record every breach with its date and the data categories exposed, then corroborate the hit with a second method. A breach listing shows historical exposure, not whether an account is compromised today.
What is Have I Been Pwned for OSINT?
Have I Been Pwned for OSINT is the practice of using Troy Hunt's free breach-notification service to confirm whether an email address has appeared in a known data breach, and treating that exposure as one corroborating signal in a wider identity investigation rather than as a standalone finding.
Have I Been Pwned (HIBP) aggregates data from publicly known breaches and lets anyone check a single email address for free, with no login required. It also runs Pwned Passwords, a k-anonymity password check that never receives the plaintext password, and separate lookups for pastes and infostealer malware logs. Domain-wide search is available after a one-time ownership verification.
Investigators use HIBP to confirm an address has a documented history of exposure, to date that exposure against other timeline evidence, and to flag which breach sources involve particularly sensitive categories of data. It answers a narrow question well: has this address appeared in a known breach, not whether an account is currently compromised.
| • | Confirming whether an email address linked to a subject has a documented history of breach exposure |
| • | Dating a breach against other timeline evidence already gathered in an investigation |
| • | Flagging sensitive-category breach sources that require careful handling before further use |
| • | Corroborating a live account-enumeration hit with independent historical breach evidence |
| • | Checking a password pattern against known compromises without submitting the plaintext password anywhere |
How do you use Have I Been Pwned for OSINT?
Six steps from a free single-address check through to a verified domain-wide search.
The following resources are used across the steps below.
Have I Been Pwned (web): Free, no login. Single-address lookup returning every breach and paste the address appears in, with breach dates and the categories of data exposed.
Pwned Passwords: Free, no login or key. Checks a password against known-breached password hashes using k-anonymity; only a partial hash is ever sent, never the plaintext password.
HIBP API v3: Free and paid tiers. An API key is required for programmatic email search, domain search and stealer-log lookups. Most domain searches remain free after one-time verification; very high-volume domains fall into paid tiers.