A while ago my email had been pwned, I changed the password. Now since the January's massive breach I checked again and my email is found to be pwned, however the password I had then change to, isn't found when searching for in the list of pwned passwords. Does that mean my email wasn't pwned a second time just the the first time? It looks to me that the list of pwned emails is accumulative of all breaches or is there a was to search in a specific breach database?


The site tells you which specific breaches it found your email address in. There are a few reasons a given breach might expose your email but not the corresponding password:

  • The breach might not have contained passwords at all. E.g. spam lists.
  • The breach might not have contained passwords for all the accounts it had, maybe because:
    • it comes from multiple sources
    • the person submitting the leak to HIBP didn't have access to the whole list/is holding onto some of the list
    • or the source protected some passwords better than others (e.g. Ashley Madison)
    • some passwords were just too strong to crack the hash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.