If leaks contain usernames and passwords, wouldn't it be important to be able to find out if one of your usernames has been compromised? Or do emails always accompany the passwords?

Fix your SMTP server: the SMTP server you are using to verify domains does not have a reverse lookup address, so emails are either rejected or marked as spam by any server that is well configured.

What potential is there to provide data on SSN that have been exposed in a breach? This seems much more borderline dangerous, but curious about of you've given any thought and the problems / possibilities you see.

a few days after I tested several of my passwords, I started receiving emails from different websites, that someone was trying to log into my accounts. and these are accounts that I haven't used for several years...

your pawny website is a a phishing scam and people should never ever use it!!!

I get email threats saying the email and password is compromised. They even list the password. But this email is not showing up in your list.

I want to use my own Password-Creation (II) without your service 'Free for 30 days'.

Thank you
Gerd Taddicken

Deutsch: Ich möchte mein eigenes Passwort kreieren, generieren ohne ihr System ,30 Tage frei für das Passwort-System'.

TSA25Jan19, 18.38 h - Local time Germany)

+++

Hello!

I lerned only two years English 1965 til 1967
(Ich lernte nur zwei Jahre englisch von 1965 bis 1967).

Please translate 'pwned' in German - I cannot find in Google a german Word foŕ it (Bitte übersetzen Sie 'pwned' in deutsch - Bei Google finde ich keine Übersetzung für 'pwned').

Normally I use 'Startpage' instead of 'Google' (Normalerweise benutze ich 'Startpage' statt Google).

Thank You - Yours faithfully
Gerd Taddicken - Germany

TSA15Jan19, 18.34 h (UTC minus 1 hour?)

+++

since we have the recommendation of 'never entering a password on a website, unless it's the password field of the according website', i'd suggest to build an send by mail request form.

if you enter your email, you can choose to get those first 5 chars of all pwned password hashes to the entered email.
with this, you ensure, that only the pwned email addresses get their pwnge data... (which ofc won't help if the mail account itself has already been hijacked)

this would help greatly, to check wich password may be leaked and need a change.

Today is the first time we have ever visited hibp. Clicking on the test http link we immediately received the blocked message shown in the title.

Everyone is very excited about this site. But honestly I am confused. I've received a message about my primary email address many times. But there's absolutely no action I can take based on that. Yes, good password hygene, yes, dont reuse passwords. But that's generic advice that I get without needing to be notified. What is the increment of information I get by receiving your email? I think that there is none. Can you help me understand your value?

I was informed that my email was on a paste AE4dYZG1.txt 6 Jan 2019 involving 3091 accounts.
The source of this breach is www.netpricedirect.co.uk.

in one of the recent blogs from you or cloudflare, it is talked that basically it would be best to deny all passwords with a count > 100 and warn on password > 20. would it be possible to create download files just for these (i think) like 10 mil records (all > 20)? that would make it easier to create a local repository database with a workable download size and working count. ... and ignoring the rare passwords which make up the largest bucket of your collection.

Would like to see some suggestions as to how to repair/improv being victims of the instances you unveil.

This can be very useful for companies to verify if their users (non-staff) are affected by any breaches and inform them to not share password for different systems. I'm residing in EU, GDPR doesn't allow us to send email to your API to check if a particular email address appear in any breach.

I asked to opt-out an e-mail address, but since I closed the e-mail account (it's already a year since) I find difficulty in confirming the verification e-mail. Any alternative thing I can do to try to block the e-mail address from showing in this site? Thanks!

Verification token sent An email containing a verification token has been sent off to the address you chose, just copy................

Kindly help for fix.

For your note:

1. Domain not blocked in mail server
2. haveibeenpwned domain - whitelisted
3. message header not found in mail server inbound logs

Perhaps as a premium service, allow a caller to post an email / password combination. HIBP responds with a recommendation on whether to allow the user to use that password on caller's system. Known pwn'd combinations would always recommend "forbid", as well as perhaps forbidding any password in the top % of pwn'd passwords by frequency.

The end goal is giving system owners a way to steer users away from not only weak but also repeat & known-compromised credentials. I understand that data extraction would be a concern, thus the "premium" service suggestion.

when I enter capital letter in domain name it is not working. Please make it case sensitive

When hitting a 429 response, a cross-origin request does not have access to the Retry-After header.

I use unique email address per subscriber, and I suddenly started receiving spam on the email I used to signup for armorgames.

They are not trustworthy. -- this is not an idea, but saw that you have listed them as unconfirmed, I can confirmed my data was leaked from their site --