# Haveibeenpwned

Check if an email address or username appears in known data breaches using the Have I...

- Repository: https://github.com/taracodlabs/aiden (868 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-19
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add taracodlabs/aiden --skill haveibeenpwned -g -a claude-code -y`
Codex: `npx skills add taracodlabs/aiden --skill haveibeenpwned -g -a codex -y`
Cursor: `npx skills add taracodlabs/aiden --skill haveibeenpwned -g -a cursor -y`
Gemini CLI: `npx skills add taracodlabs/aiden --skill haveibeenpwned -g -a gemini-cli -y`

## Description

Check if an email address or username appears in known data breaches using the Have I Been Pwned v3 API

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Have I Been Pwned, Breach Checker

Look up whether an email address has appeared in any publicly known data breaches. Uses the [Have I Been Pwned](https://haveibeenpwned.com) v3 API.

**Requires:** `HIBP_API_KEY` in `.env`, $3.50/month subscription at haveibeenpwned.com/API/Key

## When to Use

- User wants to know if their email was part of a data breach
- User wants a list of breaches an email was found in
- User is auditing accounts before a security review
- User asks "was my email leaked" or "has X been pwned"

## How to Use

### Check a single email for breaches

```powershell
$email = "user@example.com"
$key   = $env:HIBP_API_KEY
$url   = "https://haveibeenpwned.com/api/v3/breachedaccount/$([Uri]::EscapeDataString($email))?truncateResponse=false"

$result = Invoke-RestMethod -Uri $url -Headers @{ "hibp-api-key" = $key } -ErrorAction SilentlyContinue

if ($null -eq $result) {
    Write-Host "✅ $email was NOT found in any known data breaches."
} else {
    Write-Host "⚠️  $email found in $($result.Count) breach(es):"
    $result | ForEach-Object {
        Write-Host "   • $($_.Name) ($($_.BreachDate)), $($_.DataClasses -join ', ')"
    }
}
```

### Check which passwords were exposed (pastes)

```powershell
$email = "user@example.com"
$key   = $env:HIBP_API_KEY
$url   = "https://haveibeenpwned.com/api/v3/pasteaccount/$([Uri]::EscapeDataString($email))"

$result = Invoke-RestMethod -Uri $url -Headers @{ "hibp-api-key" = $key } -ErrorAction SilentlyContinue

if ($null -eq $result) {
    Write-Host "✅ No paste exposures found for $email"
} else {
    Write-Host "Found in $($result.Count) paste(s):"
    $result | Select-Object Source, Title, Date | Format-Table
}
```

### Bulk check a list of emails from a file

```powershell
$key   = $env:HIBP_API_KEY
$emails = Get-Content "emails.txt"

The rest: https://github.com/taracodlabs/aiden/blob/HEAD/workspace-templates/skills/haveibeenpwned/SKILL.md