HaveIBeenPwned

HaveIBeenPwned is an integrated data source (a Module) in UserSearch. When you run a search against it, it checks an email address against a catalogue of known data breaches and tells you which of those breaches the address appears in. It does not return passwords.

Use it when you want to establish whether an email address has been exposed in a public breach, and in which incidents, as part of an OSINT search.

What it returns

For an email address you look up, HaveIBeenPwned reports the set of known breaches that address was found in. Each breach is a named incident (for example, a specific website or service that was compromised), typically with the date it occurred and the classes of data involved.

Crucially, it reports presence in a breach, not credentials: you learn that an address was exposed and where, but the Module does not hand back the leaked password itself.

Draft — data-source behaviour awaiting confirmation

The following specifics about HaveIBeenPwned’s behaviour inside UserSearch are not yet confirmed and should be treated as draft:

• The exact fields returned per breach (breach name, date, and data classes) and how they are presented in the results table.
• Breach coverage, corpus size, and how current the breach index is (freshness).
• Whether any redaction or rate-limiting rules apply to this Module specifically.

What is solid: UserSearch integrates HaveIBeenPwned, it is a passive breach-lookup source (no interaction with the target), and it appears under the search types listed below.

Where it appears in UserSearch

HaveIBeenPwned powers these search types:

• Public Leaks — as an email breach-check Module alongside other breach and leak sources.
• Email — available when you search an email address, including through the AI Agent surface.

Because it takes an email address as input, you will typically reach it after choosing the Public Leaks or Email search type. It can also run as one of the sources inside a OneScan, which fans a single email out across several Modules at once; when it does, the Data Source column in your results attributes each row to HaveIBeenPwned.

How to access it

1. Start a search and choose the Public Leaks or Email search type.
2. Enter the email address you want to check.
3. Select the HaveIBeenPwned Module (or run a OneScan with it enabled).
4. Review the returned breaches in the results table.

Official site

Data source: haveibeenpwned.com

Reliability

Draft — reliability note

HaveIBeenPwned is a widely used, passive breach-lookup source: it reports breach membership rather than probing the target, so results reflect what has already been indexed from historical breaches. Absence from its index does not prove an address was never exposed — only that no indexed breach contains it. Coverage completeness and index freshness for this Module are not yet confirmed and should not be quoted as precise figures.

Verified against UserSearch v2.0.20