Have I Been Pwned (HIBP) is a free website run by security researcher Troy Hunt that lets anyone check whether their email address or password has appeared in a known data breach. Employees should absolutely use it — for their personal addresses as much as their work ones — because credentials stolen from other websites are one of the main raw materials of a workplace attack. The caveat: HIBP tells you a breach happened; it does not tell you what to do next. The response — changing passwords, checking reuse, enabling multi-factor authentication — is what actually protects the business.
TL;DR
- HIBP is a free, reputable breach-checking service: enter an email, see which known breaches exposed it.
- It is safe and legitimate — it holds no passwords for email lookups, only breach records from public dumps.
- Employees should check both work and personal emails, because personal-breach passwords get reused at work.
- A hit on HIBP means: change that password everywhere it was reused, and turn on MFA.
- Businesses go further by monitoring their whole domain automatically instead of relying on staff to remember to check.
What Have I Been Pwned actually does
HIBP maintains a database of hundreds of breached websites and services. When a company is hacked and its user records leak — emails, usernames and often passwords — the data ends up circulating on criminal forums. HIBP ingests those dumps, and lets you search them:
- Email search. Enter your address and see every known breach that exposed it, with the date and what data was taken.
- Password check. The Pwned Passwords service lets you test whether a specific password has appeared in any breach, using a method that never sends the full password to the server.
- Notifications. You can subscribe an address and HIBP emails you if it appears in a future breach.
- Domain monitoring. Businesses can verify a domain and get alerted when any employee address on it appears in a breach.
The service has operated since 2013 and is widely trusted across the security industry; browsers and password managers including Firefox and 1Password integrate its Pwned Passwords data directly.
Why employees should use it — and why the business should care
Attackers rarely hack a small business by breaking through the front door. They buy or harvest credentials that already exist. ASD's cyber threat reporting describes exactly this pattern: cybercriminals purchasing stolen usernames and passwords to access accounts, then using that access to launch further attacks (Annual Cyber Threat Report 2024-25). The human layer stays the dominant entry point — roughly 60% of breaches involve a human element such as a clicked link or stolen credential (Verizon, 2025 DBIR).
The uncomfortable truth is that most staff reuse passwords between work and personal life. A forum account from 2014 that leaked a password last year is a live risk to the company email account using the same passphrase today. HIBP is the fastest way for an employee to discover that connection before an attacker exploits it.
Is it safe to use?
Yes, with a clear picture of what it does and does not hold:
- It does not store your current passwords behind the email lookup — there is nothing to steal by checking an address.
- The password checker never reveals your password to the site. It sends only a short fragment of the password's hash, and the matching happens on partial data — a standard privacy-preserving design.
- It is a lookup service, not a scanner. It cannot access your accounts, and searching does not increase your risk.
The only genuine caution is behavioural: a breach listing is not a reason to panic, and it is not evidence your work account was compromised. It is a signal to act, not an alarm about a specific system.
What to do when your email appears in a breach
The listing itself is old news; the response is what matters:
- Change the password on the breached service — and anywhere else you used the same or a similar password. This is the step people skip and the one that matters most.
- Check your work credentials against the list of reused passwords. If your work password matches anything breached, change it now and make it unique.
- Turn on multi-factor authentication on email, finance and admin accounts — a breached password without a second factor is largely a dead credential.
- Watch for targeted follow-ups. Attackers use breach data to write convincing phishing emails that quote real details. If you have been breached recently, treat unexpected emails with extra suspicion and know what to do if you clicked a phishing email at work.
- Subscribe the address so future breaches reach you automatically.
For individuals vs for businesses
| Individual employees | Businesses | |
|---|---|---|
| What to do | Check personal and work emails; fix reuse; enable MFA | Monitor the whole domain continuously |
| How often | After any breach notification; yearly at minimum | Always-on monitoring |
| Limits | Relies on each person remembering to check | Needs tooling and a response process |
That second row is the real difference. An employee who checks HIBP once is protected once. A business that depends on every employee checking it voluntarily is relying on hope. The Essential Eight guidance treats credential management as a baseline control, which is why many Australian businesses fold breach monitoring into their wider programme — dark-web and breach monitoring is a standard feature in the platforms compared on the Cyber Aware comparison page, and domain monitoring is free on HIBP itself.
How HIBP fits into a broader human-risk programme
HIBP answers one narrow question: 'has this credential already leaked?' It does not tell you whether staff would recognise the phishing email that harvests the next credential. A complete programme layers three things:
- Exposure monitoring. Domain-level breach alerts so credential leaks surface without depending on staff initiative.
- Reinforcement training. Short, repeated security awareness training so stolen credentials become the backup plan rather than the entry point.
- Measurement. Regular phishing simulations with a human risk score showing whether click and report rates are actually improving.
Breach checks and simulations meet in the middle: both are about credentials that already escaped, one after the fact and one in rehearsal.
FAQ
Is Have I Been Pwned legitimate? Yes. It is run by Troy Hunt, a well-known Microsoft regional director and security researcher, has operated since 2013, and is integrated into major browsers and password managers.
Does checking my email on HIBP put me at risk? No. The email search holds no passwords, and the password check sends only a fragment of a hash. It is a read-only lookup.
My email appears in a breach I've never heard of. Am I hacked? Not necessarily. It means a service you used was breached and your address was in the data. The action is the same either way: change any reused passwords and enable MFA.
Should employees use their work email on HIBP? Yes. Checking the work address reveals which breaches exposed it, and subscribing it means future leaks arrive as a notification rather than a surprise. Businesses wanting visibility across every staff address can monitor the domain instead of relying on individuals.
What's the difference between HIBP and dark-web monitoring in security platforms? HIBP checks public breach dumps; commercial dark-web monitoring adds criminal-marketplace sources and folds alerts into a managed programme. For most small businesses, domain monitoring plus a good awareness programme covers the practical risk.
Can HIBP tell me who hacked the site or what exactly was stolen? It lists the breach name, date and data classes exposed (emails, passwords, phone numbers, and so on). For detail beyond that, read the breach's own disclosure.
One last thing
The employees who benefit most from HIBP are not the security-conscious ones who already check it — they are the ones who have never thought about password reuse. Making breach checks part of onboarding and annual training turns a personal hygiene habit into an organisational control.