{
  "slug": "have-i-been-pwned",
  "category": "online-privacy-tools",
  "name": "Have I Been Pwned",
  "description": "Searches a database of data breaches to show whether an email address, phone number or password has been exposed, and can notify subscribers about new breaches.",
  "website": "https://haveibeenpwned.com",
  "source": "https://github.com/HaveIBeenPwned",
  "license": null,
  "platforms": [],
  "jurisdiction": {
    "code": "AU",
    "name": "Australia",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "agreement"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "D",
  "score": 59,
  "coverage": 100,
  "summary": "Have I Been Pwned scores 59 out of 100 (grade D) on the privacy test tools criteria. It meets 4 of 8 criteria: no trackers or telemetry, no ads or data sales, TLS configuration and security headers. It partly meets open source. It does not meet independent audit, transparency report and tells users about requests. It is based in Australia: Five Eyes member; CLOUD Act data access agreement with the US. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.",
  "url": "https://privacyratings.com/online-privacy-tools/have-i-been-pwned/",
  "markdown": "https://privacyratings.com/online-privacy-tools/have-i-been-pwned/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "partial",
      "evidence": "https://github.com/HaveIBeenPwned/PwnedPasswordsAzureFunction/blob/main/LICENSE",
      "note": "The Pwned Passwords API, Cloudflare worker and downloader are BSD-3-Clause; the main website and breach search are closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "yes",
      "evidence": "https://haveibeenpwned.com/Privacy",
      "note": "The privacy policy states no third-party cookies or tracking pixels are used."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://haveibeenpwned.com/Privacy",
      "note": "Funded by paid subscriptions; the privacy policy states no ads or targeted marketing."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No independent audit is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No transparency report or government request policy is published."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=haveibeenpwned.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=haveibeenpwned.com",
      "note": "Grade A+ (115/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "A+",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Cloudflare Web Analytics",
        "host": "static.cloudflareinsights.com",
        "effect": "partial"
      }
    ],
    "tested_at": "2026-10-01T10:59:36.112Z"
  },
  "last_modified": "2026-10-01T11:14:42Z"
}