How Have I Been Pwned Pioneered NIST SP 800-63B's Compromised Password Requirement
When NIST Special Publication 800-63B landed in June 2017, it introduced a fundamental change in how passwords should be assessed. Rather than relying on arbitrary complexity rules, verifiers "SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised", specifically including "passwords obtained from previous breach corpuses." Within weeks, Troy Hunt wrote about the new guidance and what it meant for modern authentication, describing compromised passwords as "burned" and arguing they should never be used again.
Eight days later, Pwned Passwords launched with 306 million compromised passwords exposed in data breaches, purpose-built to turn NIST's new guidance into something organisations could actually implement. Have I Been Pwned didn't adopt that guidance years later; we were building the tooling to put it into practice as the guidance itself emerged. Today, Pwned Passwords provides a free, k-anonymity-protected API for checking passwords against an enormous corpus of breached credentials. It remains the largest and most widely integrated implementation of that control in the world, used directly by 1Password, Bitwarden, GitHub, Microsoft, Cloudflare, and thousands of organisations building NIST-aligned authentication systems.
See the NIST requirementWhat NIST 800-63B Actually Requires
"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords."
For example, the list may include: "Passwords obtained from previous breach corpuses."
| NIST Requirement or Security Consideration | How Pwned Passwords Addresses It |
|---|---|
| Check against passwords from previous breach corpuses | Pwned Passwords contains billions of compromised passwords sourced directly from breach and stealer-log data, including contributions from the FBI and NCA. |
| Protect the password while performing the check (Pwned Passwords security design) | NIST requires the prospective password to be checked against the blocklist; Pwned Passwords adds privacy protection to that process through k-anonymity. Only the first 5 characters of the SHA-1 hash are sent to the API, so the full hash and password never leave the caller's system. |
| Advise the subscriber to choose a different password if a match is found | Pwned Passwords can be checked at registration or password-change time, allowing compromised passwords to be rejected before they're used. |
| Check real-world password risk rather than impose composition rules | NIST explicitly rejects composition rules such as mandatory symbols and numbers while requiring checks against commonly used, expected or compromised passwords. Pwned Passwords provides the real-world breach corpus for that check. |
From 306 Million Passwords to Internet-Scale Infrastructure
Pwned Passwords began with 306 million passwords extracted from real-world data breaches. Today, the corpus contains billions of passwords, growing as new breach and stealer-log data is processed by Have I Been Pwned and through major contributions from law enforcement agencies including the FBI and NCA. What began as a practical way to implement NIST's new guidance has evolved into infrastructure used at enormous scale across the internet.
Pwned Passwords now serves more than 18 billion API requests every month, delivered globally from hundreds of edge locations with more than 99.9% of requests served from cache. The same service that began in 2017 as a freely downloadable corpus is now integrated into password managers, browsers, identity platforms and authentication systems around the world.
The Dataset That Law Enforcement Trusts
Pwned Passwords isn't built from wordlists or guesswork. It's built from real breach data, and law enforcement agencies contribute to it directly - because they want compromised passwords blocked before criminals can reuse them.
FBI
The FBI has been contributing passwords recovered during active criminal investigations for over four years. In December 2025, they sent 630 million more - the latest in an ongoing programme that has added over a billion passwords to the dataset from FBI investigations alone.
National Crime Agency
The UK's National Crime Agency (NCA) contributed 225 million previously unseen passwords in December 2021, recovered during their own criminal investigations.
Europol
Europol contributed credentials from multiple rounds of Operation Endgame which added millions of unique passwords to HIBP following coordinated botnet takedowns across Europe.
When the FBI sends you compromised passwords to protect people, the standard is higher than a compliance checkbox.
How to Add This Check in Four Steps
No API key required. No rate limit that blocks normal authentication traffic. Free, forever - because a compliance control that costs money to implement doesn't get implemented.
Hash the candidate password with SHA-1
SHA1("password123") → CBFDAC6008F9CAB4083784CBD1874F76618D2A97
Send only the first 5 characters
GET https://api.pwnedpasswords.com/range/CBFDA
Compare the returned suffixes locally
If the suffix for the full hash appears in the response, the password is compromised.
Reject or rotate the password
Block the password during registration or change, or proactively flag existing accounts for reset.
Frequently Asked Questions
Implement the NIST control now
Start with the free Pwned Passwords API for compromised-password screening, then use the broader HIBP platform when you need domain monitoring, breach search, stealer logs, and subscriber workflows.