';--

API key

Purchase a new HIBP subscription or manage your existing one.

Making calls to the HIBP email address search API requires a subscription which gives you a rate limited key. The same key allows you to query domains you've successfully demonstrated control of via the domain search feature, as well as search those domains via the web interface. If you've already purchased a subscription, you'll be able to manage it after verifying you have access to the email address you wish to use (you'll receive a unique link to that address). If you need help, check out the FAQs and troubleshooting guide or submit a support request.

Purchase a new key or manage an existing one

To purchase a new subscription or manage an existing one, enter your email address and follow the link that is sent to you.

Using Have I Been Pwned is subject to the terms of use

HIBP subscription

Pwned 1

10RPM

$3.95

per month

$39.50

per year

A rate limited key allowing 10 email address searches per minute, and searches of domains with up to 25 breached email addresses each †

Pwned 2

50RPM

$19

per month

$190

per year

A rate limited key allowing 50 email address searches per minute, and searches of domains with up to 100 breached email addresses each †

Pwned 3

100RPM

$32

per month

$320

per year

A rate limited key allowing 100 email address searches per minute, and searches of domains with up to 500 breached email addresses each †

Pwned 4

500RPM

$137

per month

$1,370

per year

A rate limited key allowing 500 email address searches per minute, and domain searches with unlimited breached email addresses each †

Pwned 5

1000RPM

$274

per month

$2,740

per year

A rate limited key allowing 1000 email address searches per minute, domain searches with unlimited breached accounts and stealer log searches †

† Only domains that have been added to the domain search dashboard after successfully verifying control can be searched. The number of breached accounts excludes any that appear solely in breaches flagged as spam lists. Stealer log searches also require control of domains to be demonstrated first, read the stealer log API documentation for more details.