Editor's pick
Have I Been Pwned
Check for credentials exposed in known breaches.
What it is
Troy Hunt's service, holding the largest public database of data breaches. Its Pwned Passwords API uses k-anonymity: you send only the first five characters of the hash, so the password never leaves your server.
Best for
Rejecting already-leaked passwords at sign-up.
What the free plan includes
- The password API is free and unauthenticated
- The account-by-email API requires a paid key
- Attribution and caching the range are appreciated
Free plans change often. Confirm the limits on the official page before deciding.
