';--

API key

Purchase a new HIBP subscription or manage your existing one.

Making calls to the HIBP email address search API requires a subscription which gives you a rate limited key. The same key allows you to query domains you've successfully demonstrated control of via the domain search feature, as well as search those domains via the web interface. If you've already purchased a subscription, you'll be able to manage it after verifying you have access to the email address you wish to use (you'll receive a unique link to that address). If you need help, check out the FAQs and troubleshooting guide or submit a support request.

Purchase a new key or manage an existing one

To purchase a new subscription or manage an existing one, enter your email address and follow the link that is sent to you.

Using Have I Been Pwned is subject to the terms of use

HIBP subscription

Pwned 1

10RPM

$3.50 *

per month

$35 *

per year

A rate limited key allowing 10 email address searches per minute, and searches of domains with up to 25 breached email addresses each †

Pwned 2

50RPM

$15 *

per month

$150 *

per year

A rate limited key allowing 50 email address searches per minute, and searches of domains with up to 100 breached email addresses each †

Pwned 3

100RPM

$25 *

per month

$250 *

per year

A rate limited key allowing 100 email address searches per minute, and searches of domains with up to 500 breached email addresses each †

Pwned 4

500RPM

$100 *

per month

$1,000 *

per year

A rate limited key allowing 500 email address searches per minute, and domain searches with unlimited breached email addresses each †

* Prices are introductory and will be revised upwards by between 13% and 15% on 8 October 2023 as follows: Pwned 1 to $3.95 monthly, $39.50 annually. Pwned 2 to $16.95 monthly and $169.50 annually. Pwned 3 to $28.50 monthly and $285.00 annually. Pwned 4 to $115.00 monthly and $1,150.00 annually. The price change will take effect on the next charge incurred after 8 October 2023; if an annual subscription is taken in advance of this date, no further charges will be incurred until 12 months later.

† Only domains that have been added to the domain search dashboard after successfully verifying control can be searched. The number of breached accounts excludes any that appear solely in breaches flagged as spam lists.