Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You don't need a paid subscription. The API is free.

https://haveibeenpwned.com/API/v3






Only if you want to search by account. If you want to search by password, it's free. You can query all your passwords to see which ones are breached, and change those.

> Authorisation is required for all APIs that enable searching HIBP by email address or domain, namely retrieving all breaches for an account, retrieving all pastes for an account, retrieving all breached email addresses for a domain and retrieving all stealer log domains for a breached email addresses. There is no authorisation required for the free Pwned Passwords API.

And searching by account wouldn't tell you anything useful. It would just say "Synthient Credential Stuffing Threat Data". It wouldn't tell you what password to change, because HIBP doesn't know what site the password(s) that it found in "Synthient Credential Stuffing Threat Data" were associated with, and HIBP doesn't maintain a database linking passwords to emails.


The only part of the API that is free is the passwords API, which would not help for this use case.

Every other endpoint requires a subscription. This is very far from “The API is free”.

> searching by account wouldn't tell you anything useful

The API can return the domains listed in stealer logs for a specific email address: https://haveibeenpwned.com/API/v3#StealerLogsForEmail


Sorry, I missed that you were talking about stealer logs. This specific credential dump of 2B emails wasn't a stealer log, so stealer log info will not tell you anything about this specific credential dump.

You're right that the API for stealer log info isn't free.

However, the dashboard can provide you information about stealer logs for free.

https://haveibeenpwned.com/Dashboard#StealerLogs




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: