Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use Have I Been Pwned (HIBP) to check whether your email address appears in the breach records loaded into its service. A match is a reason to review the breach details and secure affected accounts; a no-match is not proof that the address has never been exposed.

Check your email address with Have I Been Pwned

  1. Open the official Have I Been Pwned email lookup.
  2. Enter the email address you want to check and submit it.
  3. Review the result. HIBP displays breach history when it finds a match. If it reports no match, read that as “not found in the breaches loaded into HIBP,” not as a guarantee that the address has never appeared in a breach.

What a match or no-match tells you

If HIBP finds a match

Open the listed breach details and note the exposed data classes. HIBP says its breach data associates email addresses with metadata about the types of information involved; it does not store or display the actual compromised content. Password hashes are handled separately through another service. A match means the address appears in HIBP’s records. It does not, by itself, show that someone accessed your current email account.

If HIBP finds no match

The address was not found in the breach data HIBP has loaded. The service does not establish that its records cover every breach, so a no-match cannot confirm that the address has never been exposed or that your accounts are safe.

Secure accounts after a match or suspected compromise

Prioritize accounts that used the exposed address, especially if you may have reused a password. Email is particularly important: someone who can access your inbox may be able to use password-reset links to take over other accounts.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Change a compromised password to a strong, unique one. Change reused passwords on other accounts as well; there is no need to reset unrelated passwords solely because your address matched a breach.
  • Sign out of all devices on an account if you suspect someone else accessed it.
  • Turn on two-factor authentication where available, starting with your email account.
  • Check that the account’s recovery email address and phone number are yours and correct.
  • Review email settings for forwarding rules you did not create.

These steps align with the FTC’s guidance for hacked accounts. A breach-list match alone does not establish that an account was hacked; use the stronger account-recovery steps when you have reason to suspect unauthorized access.

Respond to the type of information exposed

If the breach details indicate that sensitive identity information—not just an email address—was exposed, follow the FTC’s data-breach guidance at IdentityTheft.gov. For example, if a Social Security number was exposed, the FTC advises considering steps such as ordering credit reports and placing a credit freeze or fraud alert. These measures are for relevant identity-data exposure, not a routine response to every email-address match.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Privacy when checking an address programmatically

The standard HIBP website lookup is the straightforward consumer option. For programmatic checks, HIBP’s API documentation describes two different privacy trade-offs:

  • A direct email query sends the full email address to HIBP.
  • With the documented k-anonymity method, a client sends only a partial hash prefix and checks the returned suffixes locally.

The k-anonymity approach is a technical API option, not a required step for an ordinary lookup on the website.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.