paste-leak-index
Have I Been Pwned (pwned passwords)
An index of accounts and credentials that have appeared in known data breaches. The Pwned-Passwords range endpoint is keyless, so our search can query it directly, while the fuller breach-lookup API is paid and individual account checks happen on the website itself. Use it to confirm whether a credential has surfaced in a leak. The service is flagged as degraded in our latest checks, so the website may be inconsistent to reach.
Why it’s useful & how it works
Have I Been Pwned is the standard reference for checking whether an email address or password has appeared in a known data breach or credential-stuffing leak. The Pwned Passwords service lets you check a specific password without ever sending it in full: you submit the first five characters of its SHA-1 hash and the service returns all matching hashes, so the check is private. Echo links you to the website where you can look up email addresses; the password-hash range check runs without a key.
What’s inside
The site tracks over 1,000 breached services and more than 15 billion compromised accounts. The separate Pwned Passwords dataset holds billions of unique plaintext-equivalent password hashes drawn from breach data, with major additions made regularly as new leaks are processed.
API access
https://api.pwnedpasswords.com/range/ <prefix> (keyless); breach API paid
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Cloudflare challenge HTTP 200 215 ms (challenge-platform)
- Through a datacenter proxy
- Cloudflare challenge HTTP 200 878 ms (challenge-platform)
- API, direct
- Responded HTTP 200 301 ms
- API, through a proxy
- Responded HTTP 200 831 ms
Did a real search return anything?
Returned results · 1925 results for the sample query · median 10.5 s · flaky across runs
Slow: budget for long waits, or call it asynchronously.
Benchmark coverage
Found 2 of 2 test items (100%) in the File by hash cluster. Median response 1.8 s.
By how well known the item is: 1/1 well-known, 1/1 mid .
Reachability measured 2026-08-22. Search checked 2026-08-22. Benchmark run 2026-08-22.
Access
Programmatic API access (a key may be required, see the API tag).