Have I Been Pwned, run by Troy Hunt, tells you if an email address shows up in breaches that have been shared with the site, and it can email you when a new one does. Pwned Passwords is the list managers query when you pick a password. The check uses k-anonymity: the site sees only the first five characters of the password’s hash, not the password itself.
A clean result means “not in this public corpus.” Breaches that never leaked to researchers are invisible. Pasting your password into random “check” sites is the opposite of this design. Use Hunt’s site or your manager’s built-in check. The email search reveals that an address exists in a breach. That is the feature. Do not run it on a screen you do not control.
Use it for addresses you own, and for passwords via the k-anonymity API. haveibeenpwned.com
Have I Been Pwned’s email search and the password search are different. The password API is built so the full password is not uploaded. The website form should be used on a machine you trust anyway. Domain search, for people who own a whole domain, is a paid monitoring feature and it is the one that matches a company inbox. A green result is not a medical checkup. It is a list of known dumps. Change passwords that appear. Do not reuse the new one.
