Vulnerability Scanning & Code Security
4.7/5.0
VerifiedPaidLast technical review:
Markdown for AI (.md)

Have I Been Pwned

Data breach search and notification service for security teams and developers.

Pricing

From$4.39/mo

Paid
Score

4.7/5

  1. $4.39/moCore
  2. $379/moPro
Certifications
1
Last technical review
2026-10-31
Available plansVisit website (opens in a new tab)

Technical Overview

Have I Been Pwned (HIBP) is a data breach search and notification service used by security teams, developers, and MSPs worldwide. Search tens of billions of breached records, monitor corporate domains via API, and get alerted when new breaches appear in real time.

Analyst Evaluation: Pros and Limitations

Verified Advantages

  • Comprehensive database with tens of billions of historical breached records.
  • Efficient REST API for programmatic integration into corporate systems.
  • Continuous monitoring of entire domains for early breach alerts.

Technical Considerations

  • Lacks a permanent free tier for advanced commercial or corporate use.
  • Domain verification requires strict DNS validation without flexible delegation.

Technical Capabilities & Features

4/7
Included:REST & GraphQL API
Not available:SSO / SAML Authentication
Not available:Self-Hosted Option
Included:Full Data Export
Included:Role-Based Access Control (RBAC)
Included:Custom Domains & SSL
Not available:Immutable Audit Logs
Scorecard
Show detailsHide details

Technical Scorecard: Have I Been Pwned

92/100
DX & Tech Documentation
Excellent
95/100
Pricing Fairness
Excellent
90/100
Security & Governance
Excellent
92/100
Data Portability & Sovereignty
Excellent
88/100
Performance & Reliability
Excellent
95/100

Time to Value & Fit by Segment: Have I Been Pwned

Estimated Time-to-Value< 1 hour (Immediate)

Near-instantaneous deployment with minimal technical friction.

Learning CurveLow (Intuitive)

Rapid onboarding for developers without prior training required.

Fit Index by Organization Size

Startup & Agile Teams1 to 50 members
90%
Mid-Market & Scaleup50 to 500 members
95%
Corporate Enterprise500+ members
90%
Pricing & TCO
Show detailsHide details

Pricing

$4.39/mo

Model: PAID.

Available plans:

  • Core$4.39/mo
  • Pro$379/mo
Get Have I Been Pwned (opens in a new tab)

Billing Risks & Hidden Clauses: Have I Been Pwned

Audited Billing Critical Points:
  • Las suscripciones se renuevan automáticamente salvo cancelación previa antes del ciclo de cobro.

"Core: $4.39 USD | Pro: $379 USD"

Verified Quote: /pricing
Total Cost of Ownership (TCO) Projection: Have I Been Pwned$4.39/mo
Deterministic cost estimation at 12 and 36 months based on team size, including SSO tax premiums and annual prepay discounts.
Show detailsHide details
Indie / Solo (1 active user)

Solo developer or independent technical founder.

Base Monthly Cost
$4.39/month
1 active user
12-Month Investment
$45/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$135total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 7 active users

Calculated infrastructure: VPS 1 vCPU / 2GB RAM (~$5) + 0.5h DevOps/mes ($20)

Annual VPS + DevOps Cost$300/year
Differential vs SaaS LicensingSaaS is $255/year
Startup (10 active users)

Agile engineering team in validation and early traction stage.

Base Monthly Cost
$43.9/month
10 active users
12-Month Investment
$448/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$1,344total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 26 active users

Calculated infrastructure: VPS 2 vCPU / 8GB RAM (~$15) + 2h DevOps/mes ($80)

Annual VPS + DevOps Cost$1,140/year
Differential vs SaaS LicensingSaaS is $692/year
Growth (25 active users)

Scaling company with team governance and granular access control requirements.

Base Monthly Cost
$109.75/month
25 active users
12-Month Investment
$1,119/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$3,357total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 77 active users

Calculated infrastructure: Cluster VPS 4 vCPU / 16GB RAM (~$45) + 6h DevOps/mes ($240)

Annual VPS + DevOps Cost$3,420/year
Differential vs SaaS LicensingSaaS is $2,301/year
Scaleup (100 active users)

Established organization with enterprise security policies and mandatory SAML/SSO.

Base Monthly Cost
$439/month
100 active users
12-Month Investment
$4,478/year
Includes ~15% savings via annual billing
3-Year TCO Projection (36m)
$13,434total
Consolidated software licensing expenditure

Estimated Self-Hosted VPS + DevOps Cost

Break-Even Point: Profitable starting at 212 active users

Calculated infrastructure: Infraestructura HA redundante + Backups (~$150) + 16h DevOps/mes ($640)

Annual VPS + DevOps Cost$9,480/year
Differential vs SaaS LicensingSaaS is $5,002/year
Usage Surcharges & Bill Shock Simulator: Have I Been PwnedWhat usage costs as you scale
Detect overage penalties before they impact engineering budget.
Show detailsHide details

Prototype / MVP (10 GB)

Included base quota in plan: 20 GB.
Low Risk / Predictable Bill
Base Monthly Rate
$4.39/mo
Fixed subscription or contracted tier
Overage Penalty
$0/month extra
Usage covered within plan quota
Estimated Monthly Invoice
$4.39/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Suitable for development; verify concurrent connection limits.

Base Production (50 GB)

Included base quota in plan: 20 GB.
Moderate Risk / Monitor Quota
Base Monthly Rate
$4.39/mo
Fixed subscription or contracted tier
Overage Penalty
+$5/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$9.39/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Implement table compression policies and temporal partitioning.

Active Growth (250 GB)

Included base quota in plan: 20 GB.
Critical Risk / Severe Bill Shock
Base Monthly Rate
$4.39/mo
Fixed subscription or contracted tier
Overage Penalty
+$41/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$45.39/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Offload cold backups to standard object storage (S3).

Large Scale (1.000 GB (1 TB))

Included base quota in plan: 20 GB.
Critical Risk / Severe Bill Shock
Base Monthly Rate
$4.39/mo
Fixed subscription or contracted tier
Overage Penalty
+$176/month extra
Variable surcharge for consumption above plan quota
Estimated Monthly Invoice
$180.39/mo
Total monthly cost before taxes
Technical Mitigation Recommendation:

Migrate to dedicated instance or self-hosted cluster to curtail I/O fees.

Procurement Strategy & Discounts: Have I Been PwnedB2B Negotiation Playbook
Corporate executive level with highest authority to approve budgetary exceptions.
Show detailsHide details

Fair Market Price & B2B Procurement Benchmark

Non-renewal notice: 30 days before expirationMedian achieved discount: -12%
Public List Price
$4.39 /mo
100% baseline
Audited Market Average
$4 /mo
~88% of list price
Optimized Target Price
$4 /mo
Max achievable discount (Q4 / multi-year): -20%

Verified Tactical Savings Levers

  • Annual Upfront PrepayUp to -10%

    Consolidated discount for upfront annual billing versus monthly rate.

Security & Data Exit
Show detailsHide details

Compliance & Security Standards: Have I Been Pwned

SOC 2 Type IINot reported
ISO 27001Not reported
GDPR / RGPDAudited
HIPAANot reported
PCI-DSSNot reported
Jurisdiction & Legal Sovereignty
🇦🇺Australia [AU]Immune to US CLOUD Act (EU Sovereign)GDPR DPA Available
SSO Availability (SAML Enterprise)
No SSO Documented
Data Residency
GLOBALCloudflareMicrosoft Azure
AI Privacy Policy
Zero customer data retention
Data Liberation & Migration Runbook: Have I Been PwnedJSON
Actionable escape runbook and credential export guarantees to mitigate vendor lock-in.
Show detailsHide details
Supported Structured Export Formats
JSON
Password Hash Portability
Locked: Proprietary Algorithm / No Export

Credential hashes are guarded under proprietary algorithms and cannot be exported.

CLI Command / Rescue Endpoint
GET /api/v3/edh/{domain}
Exit Protocol & Migration Notes

La exportación de reportes de dominios y alertas se realiza a través de llamadas programáticas a la API REST.

Deployment & Infrastructure Requirements: Have I Been PwnedDocker
Hardware specs and Docker directives to run on local servers, dedicated VPS, or Kubernetes without telemetry leak to the cloud.
Show detailsHide details
Minimum Memory1 GB RAM (Recommended)
Compute CPU1 vCPU
Runtime / LanguageTypeScript / Go / Rust
Code LicenseOpen Source
Docker CLI Directive
docker run -d --name have-i-been-pwned -p 8080:8080 have-i-been-pwned:latest
Companion Services & Dependencies:
PostgreSQL 15+Redis 7+
Community & Repository
Show detailsHide details

Technical Reputation of Have I Been Pwned

89/100 Technical Trust

Frequent Praises in Production

  • Comprehensive database with tens of billions of historical breached records.
  • Efficient REST API for programmatic integration into corporate systems.
  • Continuous monitoring of entire domains for early breach alerts.

Reported Production Frictions

  • Lacks a permanent free tier for advanced commercial or corporate use.
  • Domain verification requires strict DNS validation without flexible delegation.
Commercial Treatment & Vendor Lock-in:Self-Service in Dashboard

Cancellation flow is autonomous via billing portal or subscription settings.

Frequently Asked Technical Questions (Have I Been Pwned)

How do you access the Have I Been Pwned API for automated queries?

API access requires a paid subscription key such as the Core or Pro tier and uses a standard HTTP header to query email addresses or domains.

Are searched email addresses stored permanently in the system?

The service does not permanently log or store individual search queries performed on the public interface, maintaining strict privacy practices.

How does corporate domain monitoring work?

Corporate plans allow domain ownership verification via a DNS TXT record to passively audit all associated email accounts appearing in new breaches.

Direct Alternatives

All tools in Have I Been Pwned
Embed Verification Badge
Official Badge
Show detailsHide details
TheJudex Verified - Have I Been Pwned