# Data Breach Checker — Email & Password via Have I Been Pwned (`intelscrape/data-breach-checker`) Actor

Data breach checker: see if emails or passwords appear in known data breaches using the official Have I Been Pwned API. Returns breach names, dates and exposed data types, never leaked values. Password checks need no API key.

- **URL**: https://apify.com/intelscrape/data-breach-checker.md
- **Developed by:** [IntelScrape](https://apify.com/intelscrape) (community)
- **Categories:** Developer tools, Automation
- **Features:** Limited permissions
- **Stats:** 7 total users, 0 monthly users, 100.0% runs succeeded, 1 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 dataset items

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Data Breach Checker — Email & Password via Have I Been Pwned

![Actor Banner](https://api.apify.com/v2/key-value-stores/PyvJzfQg02FD3RYhd/records/data-breach-checker-banner.png)

**Check whether emails or passwords have appeared in known data breaches, in bulk.** Data Breach Checker uses the official **Have I Been Pwned (HIBP)** APIs and returns *which* breaches, *when* they happened and *what kinds* of data were exposed. It returns **metadata only, never leaked values**.

- **Password checks are free and need no API key.** They use HIBP's k-anonymity range API: only the first 5 characters of the SHA-1 hash ever leave the run, never the password.
- **Email checks use your own HIBP API key** (`hibpApiKey` input or `HIBP_API_KEY` environment variable).
- **Demo mode** returns synthetic sample rows so you can see the output before you add a key.
- Every run ends with a batch summary row: how many emails were breached, how many passwords were compromised, and the most common exposed data types.

***

### 💡 Use cases

- **Security and IT teams:** audit staff or customer email lists for breach exposure and prioritise password resets.
- **Password hygiene checks:** test candidate or default passwords against known breach corpuses before allowing them.
- **MSPs and consultants:** produce breach-exposure reports for clients.
- **Lead and CRM quality:** flag emails that appear in breaches as real, long-used addresses.
- **Fraud and trust teams:** add breach history as one signal in account-risk reviews.

***

### 🔧 Inputs

| Field | Notes |
|---|---|
| `emails` | Email addresses to check (needs an HIBP API key) |
| `passwords` | Passwords to check for free via k-anonymity (stored as a secret input) |
| `hibpApiKey` | Optional HIBP API key (secret); overrides the `HIBP_API_KEY` env var |
| `includeUnverified` | Include breaches HIBP marks as unverified (default on) |
| `requestDelayMs` | Delay between email checks to respect HIBP rate limits (default 1600 ms) |
| `maxBreachesListed` | Cap on breach details listed per email (default 100) |
| `demoMode` | Synthetic sample rows, no live HIBP calls |

### 🚀 Quick start

```json
{
  "emails": ["you@yourcompany.com"],
  "passwords": ["Summer2024!"],
  "hibpApiKey": "YOUR_HIBP_KEY"
}
```

Get a key at [haveibeenpwned.com/API/Key](https://haveibeenpwned.com/API/Key). Password checks and demo mode work without one.

### 📤 Output

One row per email or password, plus one batch summary row per run.

```json
{
  "type": "email",
  "email": "demo.user@example.com",
  "breached": true,
  "breachCount": 2,
  "mostRecentBreach": "2021-06-15",
  "dataClassesExposed": ["Email addresses", "Passwords", "Usernames"],
  "breaches": [
    { "name": "DemoBreachFixture2021", "domain": "example.com", "breachDate": "2021-06-15", "dataClasses": ["Email addresses", "Passwords"], "isVerified": true }
  ],
  "source": "hibp"
}
```

```json
{
  "type": "password",
  "passwordSha1Prefix": "5BAA6",
  "compromised": true,
  "timesSeen": 52256179,
  "advice": "Compromised — seen 52,256,179 time(s) in known breach corpuses. Do NOT use this password."
}
```

*(Values above are illustrative.)* Download results as CSV, Excel or JSON from the Output tab, or pull them with the Apify API, webhooks, Zapier or Make.

***

### ❓ FAQ

**How do I check if my email was in a data breach?**
Add the email to **Emails to check**, paste your HIBP API key, and run. Each email returns whether it was breached, the breach names and dates, and the types of data exposed.

**Do I need an API key?**
Only for email checks, because Have I Been Pwned requires one for email lookups. Password checks and demo mode need no key.

**Is it safe to check passwords here?**
Yes. The password is hashed with SHA-1 inside the run and only the first 5 characters of the hash are sent to HIBP (k-anonymity). The password itself never leaves the run and is never written to the dataset.

**Does it show leaked passwords or personal data?**
No. It returns breach metadata only: breach names, dates, domains, counts and data types. It never returns leaked values.

**How is it billed?**
Pay per event: a small start fee plus a fee per dataset row. See the **Pricing** tab on this page for the current per-event prices. You are only charged for the events listed there, and you can cap spend with the run's maximum charge setting.

**Is this affiliated with Have I Been Pwned?**
No. It is an independent Actor that calls the official public HIBP APIs.

***

### ⚖️ Compliance

- Official, consent-based HIBP APIs only: no stolen credential dumps, no hash markets, no illegal data.
- Returns breach **metadata** only (never leaked passwords or personal values).
- Check only emails and passwords you have a legitimate reason to check.
- Not affiliated with Have I Been Pwned.

### 🔗 Related tools

Each result row includes a `softCta` object with next-step links to related IntelScrape Actors such as Email Finder, Contact Info Scraper, Google Maps Email Extractor, Watson Username Search, TruePeopleSearch Scraper and Skip Trace PRO. These are links only and add no extra charges.

# Actor input Schema

## `demoMode` (type: `boolean`):

When true, pushes synthetic fixture results and does not call Have I Been Pwned. Use for Store try-outs. Default false.

## `emails` (type: `array`):

Email addresses to check for breach exposure via HIBP breachedaccount. Requires hibpApiKey input or HIBP_API_KEY env var. Ignored in demoMode.

## `passwords` (type: `array`):

Passwords to check as a JSON array. Only the first 5 chars of the SHA-1 hash are sent (k-anonymity) — the password never leaves the run. No API key needed. Ignored in demoMode.

## `hibpApiKey` (type: `string`):

Your HIBP API key for email checks (haveibeenpwned.com/API/Key). Overrides HIBP_API_KEY env if set. Stored as a secret. Not required for password checks or demoMode.

## `includeUnverified` (type: `boolean`):

Include breaches HIBP has not fully verified.

## `requestDelayMs` (type: `integer`):

Throttle to respect your HIBP rate-limit tier (raise if you see 429s).

## `maxBreachesListed` (type: `integer`):

Cap the breach detail array per email (summary fields are always returned).

## Actor input object example

```json
{
  "demoMode": false,
  "emails": [
    "test@example.com"
  ],
  "includeUnverified": true,
  "requestDelayMs": 1600,
  "maxBreachesListed": 100
}
```

# Actor output Schema

## `results` (type: `string`):

Result rows pushed to the default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "emails": [
        "test@example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("intelscrape/data-breach-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "emails": ["test@example.com"] }

# Run the Actor and wait for it to finish
run = client.actor("intelscrape/data-breach-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "emails": [
    "test@example.com"
  ]
}' |
apify call intelscrape/data-breach-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,intelscrape/data-breach-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/YHrLdOspbSBpY7W9B/builds/3UsbWTH2pcFyh3cSz/openapi.json