Is haveibeenpwned.com legit?

Yes. HasTrust rates haveibeenpwned.com Trusted (83/100), checked 2026-10-02: Widely recognized and trusted by security professionals and law enforcement agencies; Provides a free, transparent service for individuals to check if their data has been exposed in known breaches; Clear privacy policy and FAQ explaining how data is handled and how to opt out.

haveibeenpwned.com
83
Trusted🏷 Brand siteBuy
🔗https://haveibeenpwned.com

What we measured

✓Domain registered 12+ years ago
✓On the public web since 2013 (Internet Archive)
✓Valid HTTPS encryption (certificate by Google Trust Services)
Why this score?
Starting point (no evidence either way)50
Domain registered 10+ years ago+10
Among the most-visited sites (rank #1903)+12
Official website of an organisation listed on Wikidata+10
States a postal address+1
Trust score83
haveibeenpwned.com product image

Have I Been Pwned is a legitimate and widely respected cybersecurity service created by security expert Troy Hunt. It is used by individuals, organizations, and law enforcement to check if personal information has been exposed in known data breaches. While some users have reported receiving spam after using the site, the service maintains a strong reputation for transparency, and these reports are often coincidental or related to data sold by other third-party services. The site is free for individual use, with paid tiers available for organizations and domain monitoring.

See a trust score on every shop — automatically
The free extension shows this check on every store you visit, warns you before you pay on a risky one, and suggests safer or cheaper alternatives.
Get the free extension →

Video reviews

Pros

  • Widely recognized and trusted by security professionals and law enforcement agencies.
  • Provides a free, transparent service for individuals to check if their data has been exposed in known breaches.
  • Clear privacy policy and FAQ explaining how data is handled and how to opt out.

Cons

  • Some users report receiving spam after using the site, though the site denies collecting or selling email addresses.
  • The service now requires a paid subscription for advanced features like domain monitoring for 10+ accounts.
  • Results can be confusing for users who do not understand that a breach may involve a third-party service they used, rather than the specific company named.
  • Some users have reported receiving spam after using the site, though this is often attributed to coincidence or data sold by other third-party services.

What web sources say (not checked by us)

+Stated privacy policy
+Established business

Facts

Domain registered 2013-11 · 12 years old
Connection Valid HTTPS certificate
Certificate valid until 2026-12-02 (61 days) · Google Trust Services
From web sources
Founded Year: 2013
Headquarters Country: Australia
Creator: Troy Hunt
HasTrust summarizes public web sources and can be wrong or out of date. Not a guarantee of safety or quality — always verify before you buy or pay.

💬 Ask about this shop

Answers come from what we checked about this site — the AI only picks the topic, it writes nothing.

🛡️ Site safety check

✓Domain registered 12+ years ago
✓Valid HTTPS encryption (certificate by Google Trust Services)
✓On the public web since 2013 (Internet Archive)
✓Among the ~1M most-visited sites on the web (Majestic Million #1907)
–Hosted by CLOUDFLARENET - Cloudflare, Inc., US — servers registered in US.
–Domain registered via 1API GmbH.
–DNS managed by cloudflare.com.
✓The site states contact details: address
–No returns page found on the pages we read

What you should do

  • Still pay with a method that has buyer protection (credit card or PayPal), never a bank transfer.
  • Check the returns policy and delivery time before ordering.
  • We keep tracking this site — check back here if anything feels off later.

🔍 What we checked ourselves

Each row is a check HasTrust ran, and the day it ran.

CheckWhat we foundHowWhen
HTTPS certificateValid — Google Trust Services, expires 2026-12-02TLS handshake from our servers
Domain registration2013-11 (12 years old)RDAP registry record
First seen on the web2013Internet Archive
Popularity rank#1907 on Majestic MillionMajestic Million listbefore 2026-10-02
HostingCLOUDFLARENET - Cloudflare, Inc., USIP and AS lookup
Registrar1API GmbHRDAP registry record
DNScloudflare.comNameserver records
Contact & legal pagesaddressRead from the site's own pages
BlocklistNot listedHasTrust blocklist
Do you trust this site?

Buyer reports

No buyer reports yet — bought from here? Be the first to share.

Comments are screened before they appear. The count updates immediately.

Something wrong on this page? Tell us

Own this site, or spotted an error? A person reviews every report and corrects the page when a fact is wrong.

We use your email only to reply about this report.

▶ Watch video reviews

Checked 17h ago. · How we score →

Frequently asked

Is haveibeenpwned.com legit?⌄

Trusted. HasTrust trust score: 83/100. Have I Been Pwned is a legitimate and widely respected cybersecurity service created by security expert Troy Hunt. It is used by individuals, organizations, and law enforcement to check if personal information has been exposed in known data breaches. While some users have reported receiving spam after using the site, the service maintains a strong reputation for transparency, and these reports are often coincidental or related to data sold by other third-party services. The site is free for individual use, with paid tiers available for organizations and domain monitoring.

Is haveibeenpwned.com a scam?⌄

Our check surfaced no major scam signals — still verify payment and seller details before you pay.

What is the haveibeenpwned.com trust score?⌄

HasTrust rates haveibeenpwned.com 83/100 (Trusted). Buy

🔔 Email me if this shop's trust rating changes

Free. You confirm by email (double opt-in); unsubscribe any time.

📖 Helpful guides

People also checked

Own haveibeenpwned.com? Add your HasTrust badge

Show your live HasTrust score on your own site — it links back here so visitors can see the full check. How it works ↗

HasTrust trust score
Image — works anywhere
Script — tells you which pages it runs on

Same badge, added by a small script. Use this one if you want your HasTrust dashboard to show which of your pages the badge is actually seen on. It never reads your customers' data — only the page path, without the query string.

📬 Get new scams in your inbox — weekly

One short email every Monday: the scam shops and risky sites we spotted that week. No spam, one-click unsubscribe.

Double opt-in — we only mail you after you confirm.