A while ago my email had been pwned, I changed the password. Now since the January's massive breach I checked again and my email is found to be pwned, however the password I had then change to, isn't found when searching for in the list of pwned passwords. Does that mean my email wasn't pwned a second time just the the first time? It looks to me that the list of pwned emails is accumulative of all breaches or is there a was to search in a specific breach database?
The site tells you which specific breaches it found your email address in. There are a few reasons a given breach might expose your email but not the corresponding password:
- The breach might not have contained passwords at all. E.g. spam lists.
- The breach might not have contained passwords for all the accounts it had, maybe because:
- it comes from multiple sources
- the person submitting the leak to HIBP didn't have access to the whole list/is holding onto some of the list
- or the source protected some passwords better than others (e.g. Ashley Madison)
- some passwords were just too strong to crack the hash.