Troy Hunt Built the Standard. Now What?

Have I Been Pwned is where most practitioners first realise that credential exposure is a searchable fact rather than an abstract risk. Type an email address, get back a list of breaches. Subscribe a domain, get notified when any employee address appears in a new dump. It is free for the basics, built on a clean API, trusted by law enforcement worldwide, and run by a single person with unusual integrity about how breach data should be handled. These are not small things.

The limitation shows up when the CISO asks a follow-on question: "So what was actually taken? Who else has it? Is it already being used?" HIBP answers the first of those three, partially. The other two require a different class of tool — one that goes beyond breach indexing into identity correlation, stealer log forensics, or active threat intelligence. That transition is what this article maps.

A second limitation is commercial. HIBP's website search is free and always will be; the API is not. Stealer log access via the API starts at $379/month on Pro plans (as of 2025 published pricing). At high throughput — 1,000 requests/minute — the cost is $319/month; the top tier at 24,000 rpm costs $5,833/month. For an enterprise monitoring a large employee population at programmatic scale, the pricing mechanics deserve the same scrutiny as any subscription.

Neither limitation is a criticism of the product. HIBP does what it does with more transparency and ethical rigour than most of the alternatives below. This is about what happens when the job grows beyond what it was designed for.

What Have I Been Pwned Actually Does

HIBP is a breach aggregation and notification service. It collects data breach corpuses, indexes them by email address and password hash, and exposes that index through a website and an API.

Email search is the core function. Enter an email; get back a list of named breaches, their dates, and the data classes exposed (emails, passwords, phone numbers, and so on). The website is free; the API requires a paid subscription key.

Domain monitoring is the enterprise function. Configure your organisation's domains (via one of four verification methods) and HIBP will alert you when any email address on those domains appears in a newly ingested breach. This feature monitors hundreds of thousands of domains globally. Domain monitoring is available on Core plans for your own domains; Pro plans extend it to your customers' domains, which makes it viable for MSSPs.

Pwned Passwords is the developer function — a k-anonymity API for checking whether a candidate password appears in the known breach corpus, without the API ever seeing the full password. This is free, with no authentication required, and is the right integration for any authentication system that wants to block compromised passwords at the point of creation or change.

Stealer log detection is the newest substantive addition. HIBP now ingests credential records from infostealer malware logs — not just traditional database breaches — allowing it to surface an email address that appeared in a stealer log alongside the victim's corporate credentials. This is a meaningful expansion of scope; it is available only on Pro plans.

Three API tiers: Core (email search, your own domains), Pro (adds k-anonymity, stealer logs, customer domains for MSSPs), High RPM (same as Pro but at higher query volume). Entry from $4.39/month annually; stealer log capability from $379/month on Pro plans.

Under the Hood: What Makes HIBP Different From a Data Broker

The ethical architecture of HIBP is worth understanding because it is the thing that makes it genuinely trusted, and it is the thing that limits its scope.

HIBP does not store or distribute raw credentials. It stores the fact that a credential exists in a breach — the email address, the breach name, the data classes — not the password itself. Passwords in the Pwned Passwords index are stored as SHA-1 hashes and served via k-anonymity, so even the lookup does not reveal what you are searching for. This is the responsible design for a public service.

The consequence is that HIBP cannot tell you the password that appeared in a breach, who else has that record, whether it has been used in an attack, what device the credential was stolen from, or what else was on that device. Those answers live in the raw data — which HIBP deliberately does not hold. Tools that do answer those questions (stealer log platforms, raw breach database services, identity intelligence platforms) make different ethical trade-offs, and they are appropriate for different use cases.

The second structural characteristic is that HIBP is breach-centric, not identity-centric. Records are indexed by email address, and each record is associated with a named breach. There is no cross-breach identity graph linking "this email in breach A is the same person as this username in forum B, associated with this phone number in breach C." That kind of correlation is a different product — and a more powerful and more controversial one.

Where It Fits in a Security Program

HIBP fits cleanly in four places:

• Developer authentication controls. Pwned Passwords integration is the lowest-cost, highest-coverage control for blocking compromised password reuse. Every major identity framework has a reference integration. This is non-negotiable for any public-facing login.
• IT and HR credential hygiene. Domain monitoring for your own organisation's domains, with alerting routed to the security team, is a basic exposure control that requires minimal operational investment.
• MSSP domain monitoring. Pro plans supporting customer domain monitoring make HIBP viable as a scalable, transparent credential monitoring service for managed security providers.
• Incident response triage. When an identity is under investigation, HIBP provides an immediate, clean record of which named breaches that address appeared in — useful context for the first hour of an investigation.

Where it does not fit as the sole tool: any programme that needs to answer questions beyond "has this appeared and where," including what was taken, whether it is being used, who the actor is, or what other exposure the same identity carries.

What Have I Been Pwned Costs

Published pricing as of 2025 (haveibeenpwned.com/Subscription):

• Entry (annual billing): from $4.39/month ("pay for 10, get 12")
• Stealer log access: from $379/month on Pro plans
• High throughput (1,000 rpm): $319/month
• Maximum tier (24,000 rpm): $5,833/month

HIBP publishes its pricing, which is unusual in this market and genuinely useful for budgeting. The free tier is real: the website, free breach notifications, and the Pwned Passwords API are all available without payment. The commercial boundary is programmatic API access to email-level breach and stealer-log data.

Where Have I Been Pwned Is Strong — and Where Teams Look Elsewhere

Genuinely strong, and not matched by anything cheaper: Pwned Passwords is the best available password-compromise API for authentication controls, full stop. The ethical design is rigorous, the breach corpus is large and well-curated, and the trust signals from law enforcement and government partnerships are real. For organisations that need a transparent, dependency-safe, privacy-respecting breach index, HIBP is the correct answer and the alternatives below are not improvements.

Where teams look elsewhere:

• Identity correlation. HIBP returns breach records per email; it does not link an identity across breaches, platforms, or data types into a unified profile.
• Document-level exposure. HIBP has no visibility into the files inside a ransomware dump — what the PDFs contained, what the spreadsheets listed, what the mail archives revealed.
• Raw investigation data. Analysts who need to pivot from a breach record to the full record (password included) or to related records require a platform that holds and serves that data.
• Stealer log depth. HIBP can now detect stealer log appearances; it cannot provide the device context, session cookie, browsing history and infection cause that purpose-built stealer log platforms deliver.
• Active threat intelligence. HIBP is a historical index, not a live threat feed. It cannot tell you whether a threat actor is currently targeting your sector.
• Cost at scale. Stealer log access and high-RPM API usage at enterprise scale can reach price points comparable to platforms with materially more capability.

The 5 Best Have I Been Pwned Alternatives in 2026

These address different shortcomings. Read the use case column before the price.

1. DarkEye

The choice when the question has moved past "was it breached?" into "what was inside the breach, and who else is at risk?" DarkEye is a dark web and OSINT intelligence group built on correlation: emails, passwords, social accounts, crypto wallets, phone numbers and physical data are assembled into unified identity profiles across sources, and the content extracted from leaked documents — PDFs, images, mail archives, spreadsheets — is indexed and analysed rather than treated as opaque binary. When a ransomware group publishes a victim dump, DarkEye maps the exposure down to the file level. Over a petabyte of dark web data has been processed on this model.

For defenders, the portfolio spans Dark Monitor for continuous ransomware blog and market surveillance, Domain Identity Tracker, Leak Analysis for rapid impact assessment, an Automation Platform, consultancy and training. Output lands as a dashboard, an encrypted PDF, or a direct API integration into an existing SIEM or SOAR — meeting the team where it already works rather than requiring a new interface. The tooling includes HaveIBeenRansom (the search engine analogue for ransomware exposure), Breach.House for broad dark web crawling, Connector as the OSINT investigation panel, and Dark Manager for compliance. DarkEye also serves public-sector attribution use cases: identifying a person behind an alias, not merely protecting a payroll. Pricing is scoped per deployment and not published. Check our DarkEye solutions here

2. Hudson Rock

The right alternative when the shortcoming is stealer log depth rather than coverage breadth. Hudson Rock's Cavalier platform is organised around the infected machine, not the credential: each stealer-log record carries the full exfiltration bundle — session cookies, autofill data, browser history, installed applications, device fingerprint, and infection cause — making it possible to determine whether a live session token was taken (in which case password rotation is not a complete remediation), what internal systems the victim's browser knew about, and whether this is a single incident or a campaign. Integrations with Active Directory, Okta and Auth0 support automated session revocation and account deactivation. Free ad-hoc lookups make it the easiest stealer-intelligence platform to pilot; third-party analyses (2026) report continuous monitoring from around $200/month, with enterprise and API feeds by direct quote.

3. SpyCloud

The enterprise answer when the requirement is building an identity-level ATO programme rather than a notification feed. SpyCloud's recaptured-data model targets breach and malware exfiltration data early in its lifecycle, before it reaches combolists, and IDLink resolves the scattered fragments into a single resolved identity — connecting the corporate account to the personal accounts the same human has reused elsewhere, and to the malware infections associated with their devices. Products span Workforce, Endpoint, Supply Chain and Consumer Threat Protection, plus a seat-based Investigations console. Pricing is quote-only, metered by identities protected rather than by API calls; a public reseller schedule lists an SMB Employee ATO SKU at $1,788/year for 1–99 accounts (dated), while 2026 third-party analyses place enterprise contracts in the five- to six-figure annual range.

4. Enzoic

The pragmatic alternative for organisations whose primary need is blocking compromised passwords in Active Directory — the same job Pwned Passwords does, but built into the directory itself. Enzoic for Active Directory runs continuously, screening passwords at change and on a scheduled basis against its compromised credential corpus, enforcing NIST 800-63B compliance without manual process. Free for up to 20 users; paid tiers are volume-based and published: roughly $0 for the first 20 users, then approximately $1.50, $1.00, and $0.75 per user per month across successive bands (TrustRadius listings, 2026). An Exposures API extends the same data to application developers building their own credential screening. Narrowly scoped by design — this is a control, not an intelligence platform — but for teams that want the Pwned Passwords equivalent embedded in the directory, it is the most cost-effective implementation.

5. xonPlus (XposedOrNot)

The developer-friendly, cost-transparent alternative for programmatic breach and stealer-log lookup at scale. xonPlus indexes breach data and returns exposure facts — which breach, what data class, what kind of exposure — without reselling raw credentials, making it ethically comparable to HIBP in approach. It publishes flat pricing: domain monitoring from $25/month, partner plans from $99/month, and a free keyless API tier for basic lookups. At comparable throughput to HIBP's paid tiers, independent analysis (2026) places xonPlus at roughly $131/month for 1,250 rpm and $1,337/month for 25,000 rpm — substantially lower than the equivalent HIBP High RPM tiers. Stealer log exposure is included across plans rather than gated on a higher tier. Well-suited for developer teams embedding breach checking into products or for MSSPs wanting a cost-effective programmatic feed; the corpus and history are smaller than HIBP's, which matters for some use cases.

Have I Been Pwned vs the Alternatives: Full Comparison

Who Should Pick What

• Stay with Have I Been Pwned if Pwned Passwords integration is the primary use case, if ethical design and law enforcement trust signals matter for your compliance narrative, or if transparent, predictable published pricing is a procurement requirement. It does what it does better than anything comparable.
• Pick DarkEye if the breach notification told you something happened and you need to know what was actually taken — especially if the source is ransomware rather than a database breach.
• Pick Hudson Rock if the follow-on question after a breach alert is whether the attacker still holds a live session cookie and what else was on the infected device.
• Pick SpyCloud if you need to turn individual breach records into a managed programme, with identity resolution, forced remediation and IdP integrations.
• Pick Enzoic if the specific control you need is blocking compromised passwords at the Active Directory level with minimal operational overhead.
• Pick xonPlus if you are building programmatic breach lookups into a product or MSSP service and the HIBP API cost at scale has become a line item worth examining.

The Bottom Line

HIBP is not being replaced. It occupies a position in the security ecosystem that it earned through consistent, responsible operation over more than a decade — that is a real asset, and the Pwned Passwords API in particular is the kind of reference implementation that security infrastructure is rightly built on.

What it does not do is what comes after the notification: the investigation, the remediation, the correlation that determines whether one leaked email is one data point or the beginning of an account takeover campaign. That gap is not a criticism — it is the boundary of a product that was designed to be accessible and responsible. The five platforms above exist because that next question has to go somewhere, and they give it different answers depending on what your programme is actually trying to do.