HaveIBeenPwned
SecurityPasswords which have previously been exposed in data breaches. The API allows the list of pwned accounts (email addresses and usernames) to be quickly searched via a RESTful service.
📚 Documentation & Examples
Everything you need to integrate with HaveIBeenPwned
🚀 Quick Start Examples
// HaveIBeenPwned API Example
const response = await fetch('https://haveibeenpwned.com/API/v2', {
method: 'GET',
headers: {
'Content-Type': 'application/json'
}
});
const data = await response.json();
console.log(data);How to Use the Have I Been Pwned API with JavaScript
Have I Been Pwned is a free website that allows users to check if their personal information has been compromised in a data breach. The site provides an API that developers can use to integrate the data into their own applications. In this blog post, we'll cover how to use the Have I Been Pwned API with JavaScript.
How to Get a Have I Been Pwned API Key
Querying breaches or a specific account requires a paid API key (v3 is the current version). Here's how:
- Go to the API key page: https://haveibeenpwned.com/API/Key
- Choose a subscription tier — plans differ by requests-per-minute and price — and complete payment.
- Verify the email the key is tied to, then copy your 32-character hexadecimal key.
- Send it in the
hibp-api-keyrequest header (not a query string), and always set a descriptiveuser-agentheader — requests without one are rejected.
const res = await fetch(
'https://haveibeenpwned.com/api/v3/breachedaccount/test@example.com',
{ headers: { 'hibp-api-key': 'YOUR_API_KEY', 'user-agent': 'my-app' } }
);
Free, no key needed: The Pwned Passwords range API is completely free and unauthenticated — check a password by SHA-1 prefix at https://api.pwnedpasswords.com/range/{first5HashChars}. The breach-catalogue endpoints (/breaches, /breach/{name}, /dataclasses) are also key-free; only account/email lookups need a paid key. See the key page for current per-tier pricing.
Examples
We'll start with a basic example to check if an email has been pwned:
const email = 'example@domain.com';
const apiKey = 'YOUR_API_KEY';
fetch(`https://haveibeenpwned.com/api/v2/breachedaccount/${email}?api_key=${apiKey}`)
.then(response => {
if (response.ok) {
console.log(`${email} has been pwned!`);
} else {
console.log(`${email} has not been pwned.`);
}
})
.catch(error => console.error(error));
In this example, we're using the Fetch API to send a GET request to the Have I Been Pwned API. We're passing the email address as a parameter in the URL, and we're also including our API key. The response will either be a list of breaches that the email was involved in, or it will be an empty array if the email hasn't been pwned.
Next, let's search for breaches by domain:
const domain = 'domain.com';
const apiKey = 'YOUR_API_KEY';
fetch(`https://haveibeenpwned.com/api/v2/breaches?domain=${domain}&api_key=${apiKey}`)
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error(error));
This example sends a GET request to the /breaches endpoint with the domain parameter. We're also passing our API key. The response will be a list of breaches that have affected the specified domain.
Finally, let's search for a breach by name:
const name = 'Adobe';
const apiKey = 'YOUR_API_KEY';
fetch(`https://haveibeenpwned.com/api/v2/breach/${name}?api_key=${apiKey}`)
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error(error));
In this example, we're using the /breach endpoint to search for a specific breach by name. The response will be the details of the specified breach.
Conclusion
That's it! With these examples, you can start using the Have I Been Pwned API to check for data breaches in your own applications. Remember to always keep user privacy in mind and handle their data with care.
