Account recovery
HIBP login system is based solely on e-mail codes instead of the traditional username and password entry. This choice brings the expectation to provide a means of account recovery in case the user's access to their e-mail is lost. However I don't believe instructions on the website address this at all.
I have attempted to ask about this via your 'Bruce the Bot' support system, but I was unable to get any answer from it because it continuously misdirected to undesirable alternatives like "just make a new account" or "just query the public api with individual addresses", ignoring any provided context or clarification.
Based on context clues the answer is probably "no recovery options", or at best "paid plans only". Otherwise a human has to review and judge each exchange, since it'd be a bad idea to just leave account access decisions up to convincing an AI chatbot. In the off chance that a recovery flow is possible, it would be helpful to mention it, or even integrate it into the support system. Oh, and consider something other than e-mail codes; I'd rather save a 100-digit random string into my password manager than go through one more byzantine account recovery situation.
Not having passwords is a conscious decision to reduce risk. For ease of subsequent logins, we provide passkeys.
You got very clear and concise answers from Bruce: we don’t grant access to email addresses someone doesn’t control. It’s easy to add back any domains that are legitimately owned, and that position is consistent across both free and paid accounts.