You're reading about version 1 of the API which has since been superseded by version 3. There are breaking changes which make version 2 unusable, this documentation remains for historic reasons only.
There is one API endpoint only accessible via HTTP GET. The account is not case sensitive and will be trimmed of leading or trailing white spaces. The account should always be URL encoded.
GET https://haveibeenpwned.com/api/breachedaccount/{account}
The response is simply an alphabetically sorted string array of pwned websites for the account in JSON format:
["Adobe","Gawker","Stratfor"]
The sample can be invoked in the browser by clicking here or reconstructed in your tool of choice as follows:
GET HTTP/1.1
https://haveibeenpwned.com/api/breachedaccount/test%40example.com
HTTP/1.1 200 OK
["Adobe","Gawker","Stratfor"]
Response values may not be suitable for user-facing displays. They are stable (will not change in the future) and are sorted alphabetically. Current breach values are:
000webhost, 123RF, 126, 17Media, 17173, 2844Breaches, 2fast4u, 500px, 7k7k, 8fit, 8tracks, Abandonia, Abandonia2022, AbuseWithUs, AcneOrg, Activision, ActMobile, Acuity, Adapt, Adecco, ABFRL, Adobe, AdultFriendFinder, AdultFriendFinder2016, AdultFanFiction, AdvanceAutoParts, AerServ, AgusiQTorrents, AhaShare, AIType, Aimware, Aipai, Ajarn, AKP, AlpineReplay, Altenen, AmartFurniture, Ancestry, AndroidForums, AndroidLista, AnimalJam, AnimeGame, AnimeLeague, AnimePlanet, Animoto, AntiPublic, ApexSMS, APKTW, Apollo, Appartoo, Appen, Aptoide, ArmorGames, ArmyForceOnline, Artsy, Artvalue, AshleyMadison, AstroPID, AllegedATT, Aternos, AtlasQuantum, Atmeltomo, Audi, Autocentrum, Autotrader, Avast, Avito, Avvo, B2BUSABusinesses, BabyNames, Badoo, BannerBit, Banorte, BattlefieldHeroes, Battlefy, BeautifulPeople, Bell, Bell2017, Benchmark, Bestialitysextaboo, Bhinneka, bigbasket, BigMoneyJobs, BinWeevils, BiohackMe, BTSec, BitcoinTalk, Bitly, BitTorrent, BlackHatWorld, BlackBerryFans, BlackSpigotMC, BlankMediaGames, BleachAnime, BloomsToday, boAt, Bolt, BombujEu, Bonobos, Bookchor, BookCrossing, Bookmate, BotOfLegends, BourseDesVols, Boxee, BrandNewTube, Brazzers, BreachForums, BreachForumsClone, BTCAlpha, BTCE, BtoBet, BudTrader, Bukalapak, BulgarianNationalRevenueAgency, BusinessAcumen, CafeMom, CafePress, CannabisForum, Canva, CapialEconomics, CardingMafiaDec2021, CardingMafia, CashCrate, Catho, CDProjektRed, CDEK, CentralTickets, Chatbooks, CheapAssGamer, Chegg, Chess, Chowbus, ChrisLeong, Cit0day, CityBee, CityJerks, CivilOnline, ClashOfKings, ClearVoiceSurveys, ClickASnap, ClixSense, CloudPets, ClubPenguinRewritten, ClubPenguinRewrittenJul2019, Coachella, Coinmama, CoinMarketCap, CoinTracker, Collection1, TelegramCombolists, Comcast, COMELEC, CondoCom, Convex, CouponMomAndArmorGames, db8151dd, CrackCommunity, CrackedTO, CrackingForum, CraftRise, Creative, CrimeAgencyVBulletin, CrossFire, CTARS, CutoutPro, CyberServe, D3scene, DaFont, DailyQuiz, Dailymotion, DailyObjects, Dangdang, DaniWeb, DataAndLeads, PDL, DataEnrichment, DataCamp, DateHotBrunettes, DatPiff, Dave, dBforums, DCHealth, Deezer, DemandScience, DemonForums, DennisKirk, Descomplica, DevilTorrents, devkitPro, DietCom, digiDirect, Digimon, Disqus, DivXSubTitles, DLH, Dodonew, Dominos, DominosIndia, Doomworld, DoorDash, Dota2, Doxbin, DriveSure, Drizly, Dropbox, Dubsmash, DucksUnlimited, DuelingNetwork, DDO, Dunzo, Duolingo, Duowan, DVDShopCH, Dymocks, Earth2, Eatigo, EatStreet, ECCIE, Edmodo, Elance, Elanic, ElasticsearchSalesLeads, Emotet, Emuparadise, ECB, EPal, EpicGames, EpicBot, EpicNPC, Epik, Eroticy, Eskimi, EstanteVirtual, Estonia, eThekwiniMunicipality, Ethereum, EuropaJobs, Evermotion, EverybodyEdits, Evite, Evony, Exactis, Experian, Experian2020, ExploitIn, ExploreTalentAug2024, ExploreTalent, VINs, Exvagos, Eye4Fraud, EyeEm, Facebook, FacebookMarketplace, Facepunch, FaceUP, Factual, FairVoteCanada, Famm, Fanpass, FantasyFootballHub, WhiteRoom, FashionFantasyGame, FilmaiIn, FFShrine, Finsure, Fitmart, FlashFlashRevolution, FlashFlashRevolution2019, Flashback, FlexBooker, Fling, FlipaClip, FLVS, RobloxDeveloperConference2024, Foodora, Forbes, ForumCommunity, Fotolog, FoxyBingo, FreedomHostingII, FreshMenu, Fridae, Funimation, FunnyGames, FurAffinity, Gaadi, Gab, GamerzPlanet, GamesBox, GameSalad, GameSprite, GameTuts, GameVN, Gamigo, GamingMonk, GateHub, Gawker, Gett, GeekedIn, Gemini, Gemplex, GenesisMarket, GeniusU, GetRevengeOnYourEx, GFAN, GGCorp, GiantTiger, GiveSendGo, Glofox, GoGames, GoNinja, GoldSilver, gPotato, GPSUnderground, Gravatar, GSMHosting, GTAGaming, GunAuction, Playgar, GunsDotCom, Guntrader, HackForums, HackingTeam, Hathway, HauteLook, Havenly, HDBFinancialServices, HealthNowNetworks, Hemmakvall, Hemmelig, HeroesOfGaia, HeroesOfNewerth, HIAPK, Hjedd, HLTV, HomeChef, HongFire, HookersNL, HorseIsle, HotTopic, HoundDawgs, Houzz, HTCMania, HTHStudios, Hub4Tech, HuntStand, Hurb, HuskyOwners, iDTech, IDCGames, iDressup, IIMJobs, ILikeCheats, Imavex, iMenu360, iMesh, imgur, IndiaMART, IndianRailways, IndiHome, InflateVids, Insanelyi, InstantCheckmate, InstitutoNacionalDeDeportesDeChile, Intelimost, InternetArchive, Interpals, iPmart, ixigo, JamTangan, James, JD, JDGroup, Jefit, JobAndTalent, JobStreet, Jobzone, JoomlArt, JoyGames, JukinMedia, JustDate, Kaneva, KasperskyClub, KayoMoe, Kickstarter, Kimsufi, KitchenPal, KiwiFarms, KMRU, KnownCircle, Knuddels, KomplettFritid, Kreditplus, LaPosteMobile, Lanwar, Lastfm, Lazada, LBB, LDLC, LeSlipFrancais, LeadHunter, LeagueOfLegends, LeakedReality, Ledger, Leet, LegendasTV, Life360, Lifebear, Lifeboat, LightsHope, Liker, LimeVPN, LinkedIn, LinkedInScrape2023, LinkedInScrape, LinuxForums, LinuxMint, LittleMonsters, LiveAuctioneers, LiveJournal, Livpure, LizardSquad, Locally, Lolzteam, Lookbook, Lookiero, LOTR, LoungeBoard, LuLu, LuminPDF, Luxottica, LyricsMania, MacForums, MacGeneration, Mac-Torrents, MagicDuel, MailRu, MajorGeeks, MalindoAir, MallCZ, Malwarebytes, MangaTraders, MangaDex, MangaFox, Mangatoon, ManipulatedCaiman, Mappery, MarketMoveis, Mashable, MasterDeeds, MastercardPricelessSpecials, Mate1, Mathway, MCBans, MDPI, MechoDownload, MediaWorks, MeetMindful, MemeChat, MEO, MGM, MGM2022Update, MindJolt, MinecraftPocketEditionForum, MinecraftWorldMap, Minefield, Minehut, Minted, Flipkart, Habibs, MMGFusion, MobiFriends, MoDaCo, ModernBusinessSolutions, MoneyBookers, Moneycontrol, MoreleNet, MortalOnline, MovieForums, MovieBoxPro, MPGH, MrGreenGaming, MrExcel, mSpy, mSpy2024, Muah, MultiplayerIt, MuslimDirectory, MuslimMatch, MyFHA, MyFitnessPal, MyHeritage, MyPertamina, myRepoSpace, MySpace, MyVidster, NamelessMalware, NapsGear, NationalPublicData, NaughtyAmerica, NazApi, NeimanMarcus, NemoWeb, Neopets, NetEase, Neteller, NetGalley, Netlog, NetProspex, Netshoes, NextGenUpdate, NexusMods, Nihonomaru, Nitro, Nival, NonNudeGirls, NotAcxiom, NotSOCRadar, NulledCH, Nulled, NurseryCam, NVIDIA, OGUsers, OGUsers2020, OGUsers2021, OGUsers2022, OMGPOP, OnlineTrade, OnlinerSpambot, Onverse, OpenCSGO, OpenSubtitles, OperationEndgame, OrderSnapp, OrdineAvvocatiDiRoma, OVH, OwnedCore, Oxfam, PaddyPower, Pampling, Pandabuy, ParagonCheats, ParkMobile, Patreon, PayAsUGym, PayHere, PaySystemTech, Paytm, pcTattletale, Peatix, Pemiblanc, PeoplesEnergy, PetFlow, CERTPolandPhish, Phoenix, PhoneHouse, PHPFreaks, PipingRock, PixelFederation, Pixlr, piZap, PlanetCalypso, PlanetIce, Playbook, PlayCyberGames, Plex, PlutoTV, Pokebip, PokemonCreed, PokemonNegro, PoliceOne, PolishCredentials, Poshmark, Powerbot, PPCGeeks, PreenMe, ProctorU, ProgrammingForums, Promo, Promofarma, PropTiger, Protemps, PS3Hax, PSPISO, PSX-Scene, BVD, Qakbot, QatarNationalBank, QIP, QuantumBooter, QuestionPro, Quidd, QuinStreet, R2-2017, R2Games, RaidForums, RailYatri, Rambler, Rankwatch, Raychat, RbxRocks, ReadNovel, RealEstateMogul, RealDudesInc, RedDoorz, RedLineStealer, BlueSnapRegpack, Reincubate, RentoMojo, RepublicanPartyOfTexas, RetinaX, Reverb-Nation, Rightbiz, RiverCityMedia, Robinhood, Roblox, RobloxDeveloperConference, Roll20, Romwe, RosebuttBoard, RoyalEnfield, RussianAmerica, SalvadoranCitizens, SaverSpy, SCDailyPhoneSpamList, Scentbird, SchoolDistrict42, Seedpeer, Sephora, ServerPact, SevenRooms, Shadi, Shadow, ShareThis, SHEIN, Shitexpress, ShockGore, ShoeZone, ShopBack, ShopperPlus, ShortEdition, Shotbow, SirHurt, SitePoint, SkTorrent, Slickwraps, SlideTeam, Smogon, Snail, Snapchat, SoarGames, SocialEngineered, SIAE, Sonicbids, Sony, Soundwave, SpecialKSpamList, Sphero, Spirol, Sport2000, Spoutible, SpyFone, Spytech, StalkerOnline, Staminus, StarNet, Start, StarTribune, TelegramStealerLogs, SterKinekor, StockX, StoryBird, Straffic, Stratfor, StreamCraft, StreetEasy, Stripchat, StrongholdKingdoms, SubaGames, SumoTorrent, SundryFiles, SuperVPNGeckoVPN, SurveyLama, SvenskaMagic, SweClockers, Switch, SwordFantasy, Swvl, T2, TaiLieu, Tamodo, Tangerine, Taobao, TAPAirPortugal, Tappware, Taringa, Solomid, Technic, Teespring, TRAI, Teracod, Terravision, Tesco, TGBUS, TheCandidBoard, TheClubPenguinExperience, TheFappening, TheFlyOnTheWall, HalloweenSpot, TheHeritageFoundation, KodiFoundation, ThePostMillennial, TheGradCafe, TheTVDB, Thingiverse, ThisHabboForum, Tianya, Ticketcounter, Ticketek, Ticketfly, Tigo, TNAFlix, Tokopedia, ToonDoo, TorrentInvites, Toumei, Tout, Tracki, Traderie, TravelOK, Travelio, Trello, TrikSpamBotnet, Trillian, TruckersMP, TrueFire, TruthFinder, Tumblr, TunedGlobal, Tunngle, Twitter, Twitter200M, Ubook, Uiggy, Ulmon, IGF, UnderworldEmpire, UnicoCampania, Universarium, UC, UnrealEngine, Astoria, Upstox, UtahGunExchange, uTorrent, uuu9, Vakinha, Vastaamo, VBulletin, Vedantu, VerificationsIO, Verified, Vermillion, Vianet, VictoryPhones, ViewFines, VimeWorld, VivaAir, VK, VNG, Vodafone, VoidTO, VTech, VTightGel, Wakanim, Wanelo, WarInc, Warframe, Warmane, WashingtonStateFoodWorkerCard, Wattpad, WeHeartIt, WedMeGood, Weee, WeLeakInfo, Wendys, Whitepages, WHMCS, WienerBuchereien, WifeLovers, WIIUISO, WildStar, Win7Vista, Wishbone, Wishbone2020, WiziShop, Wongnai, WoTLabs, WPSandbox, WPT, xat, Xbox360ISO, Xbox-Scene, xHamster, Xiaomi, XKCD, XPGameSaves, XSplit, Yahoo, Yam, Yandex, Yatra, YoteprestoCom, Youku, YouNow, YouPorn, YouveBeenScraped, Zacks, ZadigVoltaire, ZAPHosting, Zhenai, ZLib, Zomato, Zoomcar, Zoosk, Zoosk2020, Zooville, Zurich, Zynga, Parapa, SprashivaiRu, DecoratingTheHouse
Semantic HTTP response codes are used to indicate the status of the search:
| Code | Description |
| 200 | Ok — everything worked and there's a string array of pwned sites for the account |
| 400 | Bad request — the account does not comply with an acceptable format (i.e. it's an empty string) |
| 404 | Not found — the account could not be found and has therefore not been pwned |
The API must be invoked over HTTPS. Any requests over HTTP will result in a 301 response with a redirect to the same path on the secure scheme.
CORS is fully supported for all origins — you can hit the API from websites on any other domain.
There isn't any.
There isn't any of that either.
There's not much point; if you want to build up a treasure trove of pwned email addresses or usernames, go and download the dumps (they're all just a Google search away) and save yourself the hassle and time of trying to enumerate an API one account at a time.