Security — entry 016 of 30
HaveIBeenPwned
HaveIBeenPwned aggregates hundreds of data breaches and public paste dumps so anyone can check whether an email address, domain, or password has been exposed. Pwned Passwords answers password checks anonymously via a k-anonymity hash-range query and needs no key, while the breach- and paste-search endpoints sit behind a paid subscription API key. Troy Hunt's service has become a de facto industry check, feeding into browsers, password managers, and countless other security tools.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/haveibeenpwned/"><img src="https://greatapis.com/badge/haveibeenpwned.svg" alt="Scored 61 on greatapis.com"></a>Auth quickstart
- Sign up with the provider to get an API key.
- Send it on every request as a header
Authorization: <key> - The exact header isn't documented — Authorization is a common default; confirm in the provider's docs.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Developer reference
Core 1 tier: 10 requests/minute (scaling up per paid tier: Core 2=50, Core 3=100, Core 4=500, Core 5=1,000; Pro 1=1,000 up to Pro 5=16,000; High RPM plans 4,000-24,000 rpm) -- per haveibeenpwned.com/API/v3 and haveibeenpwned.com/Subscription