Have I Been Pwned Breaches API

Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 19 Aug 2026

What is the Have I Been Pwned Breaches API?

The Have I Been Pwned breaches endpoint is a free, key-free API returning the full catalogue of known data breaches — company, breach date, number of accounts affected and which data types were exposed.

While checking whether a specific account was breached requires a paid HIBP key, the catalogue of breaches themselves is completely open. That covers hundreds of incidents with structured metadata on each.

The `DataClasses` array is the most useful field: it lists exactly what was exposed in each breach — email addresses, passwords, physical addresses, payment histories. That lets you assess severity programmatically rather than by reading prose.

Quick facts

Base URL: https://haveibeenpwned.com/api/v3
Authentication: The breaches list needs no key. Searching a specific email address requires a paid API key.
Rate limit: No key needed for this endpoint; be reasonable and cache — the list changes rarely.
Pricing: Free for the breach catalogue; account search is a paid subscription.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Have I Been Pwned Breaches API

Every request below was executed against the live API on 19 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Fetch the full breach catalogue

GET https://haveibeenpwned.com/api/v3/breaches

curl

curl 'https://haveibeenpwned.com/api/v3/breaches'

JavaScript (fetch)

const res = await fetch("https://haveibeenpwned.com/api/v3/breaches");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://haveibeenpwned.com/api/v3/breaches", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

[
  {
    "Name": "000webhost",
    "Title": "000webhost",
    "Domain": "000webhost.com",
    "BreachDate": "2015-03-01",
    "AddedDate": "2015-10-26T23:35:45Z",
    "ModifiedDate": "2017-12-10T21:44:27Z",
    "PwnCount": 14936670,
    "Description": "In approximately March 2015, the free web hosting provider <a href=\"http://www.troyhunt.com/2015/10/breaches-traders-plain-text-passwords.html\" target=\"_blank\" rel=\"noopener\">000webhost suffered a major data breach</a> that exposed almost 15 million customer records. The data was sold and traded before 000webhost was alerted in October. The breach included names, email addresses and plain text passwords.",
    "LogoPath": "https://logos.haveibeenpwned.com/000webhost.png",
    "Attribution": null,
    "DisclosureUrl": null,
    "DataClasses": [
      "Email addresses",
      "IP addresses",
      "Names",
      "Passwords"
    ],
    "IsVerified": true,
    "IsFabricated": false,
    "IsSensitive": false,
    "IsRetired": false,
    "IsSpamList": false,
    "IsMalware": false,
    "IsSubscriptionFree": false,
    "IsStealerLog": false
  },
  {
    "Name": "123RF",
    "Title": "123RF",
    "Domain": "123rf.com",
    "BreachDate": "2020-03-22",
    "AddedDate": "2020-11-15T00:59:50Z",
    "ModifiedDate": "2020-11-15T01:07:10Z",
    "PwnCount": 8661578,
    "Description": "In March 2020, the stock photo site <a href=\"https://www.bleepingcomputer.com/news/security/popular-stock-photo-service-hit-by-data-breach-83m-records-for-sale/\" target=\"_blank\" rel=\"noopener\">123RF suffered a data breach</a> which impacted over 8

Parameters

Parameter	Type	Required	Description
`Domain`	string	Optional	Filter to breaches for a specific domain. `adobe.com`
`IsSpamList`	boolean	Optional	Include or exclude spam lists. `false`
`User-Agent`	header	Required	HIBP requires a descriptive User-Agent identifying your app. `MyApp/1.0`

Response fields

Namestring: Machine-readable breach identifier.
Titlestring: Human-readable breach name.
Domainstring: Domain of the breached service.
BreachDatestring: Date the breach occurred.
PwnCountinteger: Number of accounts compromised.
DataClassesarray: What was exposed — passwords, emails, addresses and so on.
IsVerifiedboolean: Whether HIBP verified the breach as genuine.

What you can build with the Have I Been Pwned Breaches API

Display a searchable database of known breaches
Assess breach severity programmatically from the exposed data classes
Alert users when a service they use appears in a new breach
Support security research and awareness training

Common errors and how to fix them

403

Missing or generic User-Agent.

Fix: HIBP requires a descriptive User-Agent naming your application; requests without one are blocked.

401 on account search

That endpoint requires a paid API key.

Fix: Only the breaches catalogue is free. Searching whether an email was breached is a paid subscription.

Large response

The full catalogue is several hundred KB.

Fix: Cache it — new breaches are added occasionally, not continuously.

Have I Been Pwned Breaches API — frequently asked questions

Is the Have I Been Pwned API free?

The breach catalogue endpoint is free with no key. Searching whether a specific email address appears in breaches requires a paid API subscription.

Why do I get a 403 error?

HIBP requires a descriptive User-Agent header identifying your application. Requests with a default or missing User-Agent are rejected.

What is the DataClasses field?

An array naming exactly what was exposed in that breach — email addresses, passwords, physical addresses, payment histories and so on. It is the best signal of severity.

How do I check a specific password instead?

Use the separate Pwned Passwords range endpoint, which is free, unauthenticated and uses k-anonymity so the password never leaves your server.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

Password Generator

Generate strong random passwords with cryptographically secure randomness. Choose length and character sets, see entropy strength, copy instantly.

Alternatives to Have I Been Pwned Breaches API

If Have I Been Pwned Breaches does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
SSL Labs	Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.	No key	No	19 Aug 2026
SANS Internet Storm Center	Free SANS Internet Storm Center DShield API with no key: most-targeted ports, attacking source counts, IP reputation and daily internet threat data from a global sensor network.	No key	Yes	21 Aug 2026
Kickbox Disposable	Free Kickbox open API with no key: check whether an email domain is disposable. Returns a single boolean, extremely fast and simple. Tested curl example.	No key	No	19 Aug 2026

All Security & Auth APIs

Have I Been Pwned Breaches is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 19 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.