---
title: "Have I Been Pwned?"
url: https://perrotta.dev/2025/03/have-i-been-pwned/
last_updated: 2026-02-16
---


[Have I Been Pwned?](https://haveibeenpwned.com/) by the great [Troy Hunt](https://www.troyhunt.com/):

> Check if your email address is in a data breach

## Individual sign-up

Sign up and then verify your email:

> You've just been sent a verification email, all you need to do now is confirm
> your address by clicking on the link when it hits your mailbox and you'll be
> automatically notified of future pwnage. In case it doesn't show up, check
> your junk mail and if you still can't find it, you can always repeat this
> process.

The email:

> You (or possibly someone else), just subscribed `{email}` to the
> notification service that will automatically let you know if your address is
> caught up in a future data breach. It's a free service and you can unsubscribe
> at any time if you don't want the notifications.
>
> Just to confirm that you're a real person behind a real email address, click
> on the link below then you'll be automatically subscribed to new breach
> notifications where this email address has been pwned.

Then:

> Verification complete
>
> All done, you'll be sent an email if this address gets pwned in future, below
> is your existing exposure

There's a lot of lore in the [PWNED — The Collected Blog
Posts](https://www.goodreads.com/book/show/74960566-pwned---the-collected-blog-posts)
book by Troy Hunt & Rob Conery, which I would recommend.

## Domain sign-up

Furthermore, there's also a domain search service:

> Search for pwned accounts across an entire domain and receive future
> notifications.

> Domain search allows you to find all breached email addresses on a domain you
> control via a dedicated domain search dashboard. Once verified, you will also
> receive notifications via email if they appear in future breaches. Before you
> can perform a domain search, you need to verify your email address and that
> you control the domains you're searching. If you cannot verify that you
> control a domain, you will not be able to search for breached email addresses
> on it.

Upon signing up:

> Welcome to the Have I Been Pwned domain search
>
> You (or possibly someone else), just began the process to access the domain
> search dashboard using the email address `{email}`. Just to confirm
> that you're a real person behind a real email address, click on the link below
> which will take you to the dashboard (the link will remain valid for 60
> minutes).

Then you can choose a way to verify your domain:

- with a pre-defined address like `security@` or `webmaster@` or `postmaster@`
  or `hostmaster@`
- with a DNS TXT record

When following the first route:

> An email containing a verification token has been sent off to the address you
> chose, just copy and paste it into the text box below and you'll be able to
> perform the domain search right after that.

I was already familiar with the individual service, but only now discovered the
domain service, at work, by happenstance.