BYTETOOLS

Have I Been Pwned Breaches API

Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-19

What is the Have I Been Pwned Breaches API?

The Have I Been Pwned breaches endpoint is a free, key-free API returning the full catalogue of known data breaches — company, breach date, number of accounts affected and which data types were exposed.

While checking whether a specific account was breached requires a paid HIBP key, the catalogue of breaches themselves is completely open. That covers hundreds of incidents with structured metadata on each.

The `DataClasses` array is the most useful field: it lists exactly what was exposed in each breach — email addresses, passwords, physical addresses, payment histories. That lets you assess severity programmatically rather than by reading prose.

Quick facts

Base URL
https://haveibeenpwned.com/api/v3
Authentication
The breaches list needs no key. Searching a specific email address requires a paid API key.
Rate limit
No key needed for this endpoint; be reasonable and cache — the list changes rarely.
Pricing
Free for the breach catalogue; account search is a paid subscription.
CORS
Enabled — callable directly from browser JavaScript
Official docs
Read the docs

How to use the Have I Been Pwned Breaches API

Every request below was executed against the live API on 2026-08-19, and the response shown is the real body it returned — not an illustration.

1. Fetch the full breach catalogue

GET https://haveibeenpwned.com/api/v3/breaches

curl
curl 'https://haveibeenpwned.com/api/v3/breaches'
JavaScript (fetch)
const res = await fetch("https://haveibeenpwned.com/api/v3/breaches");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.get("https://haveibeenpwned.com/api/v3/breaches", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200 (truncated)
[
  {
    "Name": "000webhost",
    "Title": "000webhost",
    "Domain": "000webhost.com",
    "BreachDate": "2015-03-01",
    "AddedDate": "2015-10-26T23:35:45Z",
    "ModifiedDate": "2017-12-10T21:44:27Z",
    "PwnCount": 14936670,
    "Description": "In approximately March 2015, the free web hosting provider <a href=\"http://www.troyhunt.com/2015/10/breaches-traders-plain-text-passwords.html\" target=\"_blank\" rel=\"noopener\">000webhost suffered a major data breach</a> that exposed almost 15 million customer records. The data was sold and traded before 000webhost was alerted in October. The breach included names, email addresses and plain text passwords.",
    "LogoPath": "https://logos.haveibeenpwned.com/000webhost.png",
    "Attribution": null,
    "DisclosureUrl": null,
    "DataClasses": [
      "Email addresses",
      "IP addresses",
      "Names",
      "Passwords"
    ],
    "IsVerified": true,
    "IsFabricated": false,
    "IsSensitive": false,
    "IsRetired": false,
    "IsSpamList": false,
    "IsMalware": false,
    "IsSubscriptionFree": false,
    "IsStealerLog": false
  },
  {
    "Name": "123RF",
    "Title": "123RF",
    "Domain": "123rf.com",
    "BreachDate": "2020-03-22",
    "AddedDate": "2020-11-15T00:59:50Z",
    "ModifiedDate": "2020-11-15T01:07:10Z",
    "PwnCount": 8661578,
    "Description": "In March 2020, the stock photo site <a href=\"https://www.bleepingcomputer.com/news/security/popular-stock-photo-service-hit-by-data-breach-83m-records-for-sale/\" target=\"_blank\" rel=\"noopener\">123RF suffered a data breach</a> which impacted over 8

Parameters

ParameterTypeRequiredDescription
DomainstringOptionalFilter to breaches for a specific domain. adobe.com
IsSpamListbooleanOptionalInclude or exclude spam lists. false
User-AgentheaderRequiredHIBP requires a descriptive User-Agent identifying your app. MyApp/1.0

Response fields

Namestring
Machine-readable breach identifier.
Titlestring
Human-readable breach name.
Domainstring
Domain of the breached service.
BreachDatestring
Date the breach occurred.
PwnCountinteger
Number of accounts compromised.
DataClassesarray
What was exposed — passwords, emails, addresses and so on.
IsVerifiedboolean
Whether HIBP verified the breach as genuine.

What you can build with the Have I Been Pwned Breaches API

  • Display a searchable database of known breaches
  • Assess breach severity programmatically from the exposed data classes
  • Alert users when a service they use appears in a new breach
  • Support security research and awareness training

Common errors and how to fix them

403

Missing or generic User-Agent.

Fix: HIBP requires a descriptive User-Agent naming your application; requests without one are blocked.

401 on account search

That endpoint requires a paid API key.

Fix: Only the breaches catalogue is free. Searching whether an email was breached is a paid subscription.

Large response

The full catalogue is several hundred KB.

Fix: Cache it — new breaches are added occasionally, not continuously.

Have I Been Pwned Breaches API — frequently asked questions

Is the Have I Been Pwned API free?

The breach catalogue endpoint is free with no key. Searching whether a specific email address appears in breaches requires a paid API subscription.

Why do I get a 403 error?

HIBP requires a descriptive User-Agent header identifying your application. Requests with a default or missing User-Agent are rejected.

What is the DataClasses field?

An array naming exactly what was exposed in that breach — email addresses, passwords, physical addresses, payment histories and so on. It is the best signal of severity.

How do I check a specific password instead?

Use the separate Pwned Passwords range endpoint, which is free, unauthenticated and uses k-anonymity so the password never leaves your server.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

Password Generator

Generate strong random passwords with cryptographically secure randomness. Choose length and character sets, see entropy strength, copy instantly.

Have I Been Pwned Breaches is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-19; always check the official documentation before relying on this API in production, as terms and limits can change.