1

A while ago my email had been pwned, I changed the password. Now since the January's massive breach I checked again and my email is found to be pwned, however the password I had then change to, isn't found when searching for in the list of pwned passwords. Does that mean my email wasn't pwned a second time just the the first time? It looks to me that the list of pwned emails is accumulative of all breaches or is there a was to search in a specific breach database?

0

1 Answer 1

4

The site tells you which specific breaches it found your email address in. There are a few reasons a given breach might expose your email but not the corresponding password:

  • The breach might not have contained passwords at all. E.g. spam lists.
  • The breach might not have contained passwords for all the accounts it had, maybe because:
    • it comes from multiple sources
    • the person submitting the leak to HIBP didn't have access to the whole list/is holding onto some of the list
    • or the source protected some passwords better than others (e.g. Ashley Madison)
    • some passwords were just too strong to crack the hash.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .