Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [have-i-been-pwned]

Website allowing internet users to check whether their credentials have been compromised in the past.

0
votes
0answers
104 views

Have I Been Pwned Breached Email List by Domain Names

HIBP is a great service that I've been using for a long time. I had a question surrounding Domain Search feature on HIBP. I believe there has to be some form of verification from our end in order to ...
2
votes
2answers
133 views

Is haveibeenpwned (HIBP) free and reliable? [closed]

I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces. AS per my read I have 3 options to check out. Download the password dictionary and implement my ...
34
votes
6answers
6k views

How do I reset passwords on multiple websites easily?

One of my old email addresses was involved in the recent Whitepages breach disclosure (source: Have I Been Pwned). I don't remember on which websites I used that email address for registration, but I ...
1
vote
0answers
37 views

Are there any reliable and updated sources or feeds for password dumps? [closed]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
2
votes
1answer
63 views

How did my exact name + birthday end up in PwnedPassword lists? [closed]

I find my exact name + birthday in the form of FirstnameMiddlenameSurnameDayMonthYear, e.g. JamesWilliamMiller31052000 in the PwnedPasswords List. But I have a very uncommon Surname (<100 people) ...
76
votes
4answers
19k views

How can I be pwned if I'm not registered on the compromised site?

I recently was emailed from HaveIBeenPwned.com (which I am signed up on) about the ShareThis website/tool (not signed up on). I have no memory of signing up for that service. When I go to recover ...
0
votes
1answer
127 views

Search list of emails [HaveIBeenPwned] [closed]

I want to search a list of emails, about 150 roughly on the https://haveibeenpwned.com/ website. Obviously, I do not want to search each address individually, is there a way to upload a list, or ...
1
vote
1answer
121 views

Email pwned versus password not pwned

A while ago my email had been pwned, I changed the password. Now since the January's massive breach I checked again and my email is found to be pwned, however the password I had then change to, isn't ...
67
votes
10answers
20k views

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
6
votes
2answers
2k views

Why is breach-detection site “Have I Been Pwned” considered safe?

Whether it be due to technology the site is using, or any manual behind-the-scenes work with the data, why does this breach detection site seem to be unquestioningly safe? Wouldn't the data of you, ...
94
votes
6answers
24k views

Is it safe to give my email address to a service like haveibeenpwned in light of the publication of “Collection #1”?

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g. Have I Been Pwned. ...
1
vote
1answer
422 views

Search on email domains using the Have I Been Pwned API?

Using the HIBP API, is it possible to search for email domains? I know that HIBP has around 5 billion email records. All I want is a count of gmail.com or yahoo.com records. I know that I can check ...
39
votes
4answers
12k views

Is it safe to check password against the HIBP Pwned Passwords API during account registration?

User registers account on a web app. Passwords are salted and hashed. But is it safe to check the password against the HIBP Pwned Passwords API, before salting and hashing it? Of course the app uses ...
152
votes
8answers
54k views

Is “Have I Been Pwned's” Pwned Passwords List really that useful?

My understanding of Have I Been Pwned is that it checks your password to see if someone else in the world has used it. This really doesn't seem that useful to me. It seems equivalent to asking if ...