Have I Been Pwned: is it safe, and what to do if you are pwned

Have I Been Pwned is a free, trustworthy website that tells you whether your email address appears in a known data breach. On haveibeenpwned.com you only enter your email address, never a password, and you see right away which services leaked your details and what kind of data was exposed. Searching by phone number is no longer possible on the website, but each breach does show whether phone numbers were part of it.

This article explains how the check works, why the site is safe to use, what to do when your address turns up and, if your email or website is hosted with LJPc hosting, how to lock down your mailbox and customer portal straight away.

What is Have I Been Pwned, and what does pwned mean?

Have I Been Pwned, or HIBP, was set up in 2013 by Australian security researcher Troy Hunt. It collects data from breaches that have been leaked or published and lets you search whether your email address is in them. As of November 2026 it holds more than 1,000 breaches with over 17.8 billion breached accounts in total.

Pwned is gamer slang: a corruption of "owned", because the p sits right next to the o on a keyboard. Being pwned means being taken over or compromised. On HIBP it means your details are in at least one breach. That does not mean someone has logged in to your account, but it does mean your data may be in the wrong hands.

Is Have I Been Pwned safe and legit?

Yes. HIBP is one of the best-known breach lookup services and has been running since 2013. Governments use it too: the Dutch National Cyber Security Centre (NCSC) has monitored government domains with it since July 2021, and dozens of other national governments have the same access. Here is why the site is safe to use:

• You only enter your email address. The search never asks for a password. According to the site, searches are not logged and everything runs over an encrypted connection.
• No passwords are stored next to email addresses. When HIBP loads a breach, it loads the email addresses but never the passwords that belong to them. That is also why you can never retrieve an old password of yours there.
• Sensitive breaches are hidden. Breaches where being listed could harm you, such as those of dating sites, are only shown to the verified owner of the address.
• HIBP only mails from noreply@haveibeenpwned.com. It will never send you your leaked password. A message that offers to do so, or asks you to open an attachment, is phishing.

Do make sure you are on the official site: the address bar should read haveibeenpwned.com. Type the address yourself rather than clicking a "breach check" link in an email or ad. How to spot fake messages is covered in email security against phishing, spam and abuse.

Keep in mind that HIBP only knows about breaches that have been loaded into it. A clean result is good news, not a guarantee that your data has never leaked anywhere. A unique password for every service remains your best protection.

How to check if your email has been in a data breach

1. Go to https://haveibeenpwned.com.
2. Type your address into the Email address field and click Check.
3. Good news means your address is not in any breach HIBP knows about.
4. Oh no means it is. You get a timeline of the breaches that include your address, newest first.
5. Open a breach for the details. Compromised Data lists what leaked, such as email addresses, passwords, phone numbers or physical addresses, and Recommended Actions tells you what to do next.
6. Repeat the check for every address you use or have used: work, personal and any old address that is still the login for an account somewhere.

Below the breaches you may also see Paste Records: places where your address was shared openly in a text file or list, for example on a paste site.

Can I check my phone number on Have I Been Pwned?

Not any more. Since the relaunch in May 2025 the website only searches by email address. Phone number search had only ever been added for the large Facebook breach loaded in 2021 and was removed from the website in that relaunch.

To find out whether your number leaked, check your email address and look at Compromised Data for each breach found. If it lists Phone numbers, your number was in that breach. One example is the breach at Dutch telecom provider Odido in February 2026: it exposed more than 6 million email addresses together with phone numbers, home addresses, bank account numbers and ID document numbers. Odido customers find it by searching for their email address.

If your phone number leaked, expect more scam texts, WhatsApp messages and calls from people posing as a company you know or as a friend or relative. Never pass on a code you receive by text, and never transfer money after such a message without first calling back on a number you know.

Your email is in a data breach: what to do now

Being listed means your data may have reached others. These steps limit the damage and keep your accounts under your control:

1. Check what leaked. That decides what you need to do (see the table below).
2. Change any leaked password, at the breached service and everywhere you use the same or a similar password. Attackers automatically try leaked email and password combinations on other sites; this is called credential stuffing.
3. Use a unique password for every service from now on. A password manager creates and remembers strong passwords for you.
4. Turn on two-factor authentication wherever it is offered. How it works is explained in set up two-factor authentication (2FA).
5. Be extra alert to phishing. Criminals use breached data to make their messages convincing, for example by including your name or customer number.
6. Sign up for alerts about future breaches with Notify Me (see below).

Stealer logs: when your device was infected

Some data in HIBP does not come from a breach at a company but from stealer logs: data collected by malware on infected computers that captures login details as you type them. You can see whether your address appears in them after signing in to the HIBP dashboard. If it does, scan your devices with an up-to-date virus scanner and change your passwords from a device you know is clean.

Get an alert when your email turns up in a new breach

1. Go to haveibeenpwned.com/NotifyMe.
2. Enter your email address and click Notify Me.
3. Open the email from noreply@haveibeenpwned.com and click the link to confirm.

The service is free. You can only sign up an address you receive mail on, because the confirmation and the alerts go to that address. Under Dashboard you sign in with a link by email or with a passkey; there you also see hidden sensitive breaches and stealer log entries for your address. Prefer not to show up in public search results at all? Use Opt Out to hide your address.

Check a password with Pwned Passwords

On haveibeenpwned.com/Passwords you can check whether a password has ever appeared in a breach. Your password does not leave your device: your browser turns it into a SHA-1 hash and sends only the first five characters to HIBP. The site returns a list of possible matches and your browser compares them locally. This approach is called k-anonymity.

If the result says Oh no, never use that password again, not even in a slightly changed form. Many password managers and browsers also check your saved passwords against breaches and warn you when one is affected.

Secure your mailbox and customer portal at LJPc hosting

Is your business email address with LJPc hosting in a breach, or did you use your mailbox password somewhere else as well? You can fix it yourself right away in the customer portal:

• New mailbox password. Go to Services, Sites, pick your site and, in the Email addresses block, click the key icon (Change password) next to your address. Then enter the new password on all your devices. The steps are in set up email on your phone, tablet and computer.
• New portal password. Click your name in the top right corner, choose My account and open the Security tab. More in signing in to the customer portal.
• A second step that is always on. A password alone never gets anyone into the customer portal: it is always followed by a code by email or from your authenticator app, or you sign in with a passkey. Set up an authenticator app or passkey and even someone with access to your mailbox cannot get into your portal. If you receive a sign-in code while you are not signing in, change your password straight away and let us know.
• Check your webmail. Sign in to LJPc webmail and look in the Verzonden (Sent) folder for messages you did not send yourself.

Worried someone else has been in your mailbox, or want us to take a look with you? Call +31 85 130 6429, email support@ljpc.nl or create a support ticket. We will get to the bottom of it together.