Tools · Ethical OSINT and privacy self-defense · 09 / 17
Monitoring breach exposure for your domain with Have I Been Pwned
Verify your domain with Have I Been Pwned, see which employee addresses appear in known breaches, check passwords safely with k-anonymity, and respond without handling leaked data.
What HIBP provides
Have I Been Pwned (HIBP) indexes email addresses found in public data breaches. Individuals can check their own address. Organizations can verify domain ownership and then see which addresses on their domain appear in which breaches and receive notifications for new ones. The Pwned Passwords service lets you check whether a password appears in breaches without sending the password.
Checking passwords with k-anonymity
The Pwned Passwords range API takes only the first five characters of the SHA-1 hash of a password and returns all hash suffixes with that prefix. Your code compares locally, so the password and its full hash never leave your machine. Identity providers and password managers use the same API to block breached passwords.
pw='correct horse battery staple'
h=$(printf '%s' "$pw" | sha1sum | awk '{print toupper($1)}')
curl -s "https://api.pwnedpasswords.com/range/${h:0:5}" | grep -i "^${h:5}:" || echo 'not found in breaches'Lab: check yourself and plan a response
Check your own email address on HIBP and note which breaches include it and what data types were exposed. Check one of your old passwords with the k-anonymity method above, never by typing it into a web form you do not trust. If you administer a domain, verify it and review the domain search. Write a response plan: notify affected users, require password changes where reuse is likely, and confirm MFA is enabled.
Limits and ethics
HIBP shows that an address appeared in a breach, not the leaked password. Do not seek out or download breach dumps to “check” them; handling stolen data carries legal and ethical risk and is unnecessary for defense. Focus on actions: unique passwords, MFA, and breached-password blocking at sign-in.
Diagram
Pwned Passwords range check
- Hash locally
SHA-1 of the password on your machine.
- Send prefix
Only the first 5 hex characters go to the API.
- Receive suffixes
All hashes sharing that prefix, with counts.
- Compare locally
Match your suffix; nothing sensitive was sent.
Check yourself
1. What does the Pwned Passwords range API receive from your client?
2. What must an organization do before seeing all breached addresses on its domain?
3. Why avoid downloading breach dumps for checks?