MyRecon vs Have I Been Pwned

Short answer

For checking an email against breaches, and being alerted to new ones, Have I Been Pwned is the reference service and you should use it. MyRecon is for everything around that check: combining several breach sources in one answer, then moving on to the usernames, domains, DNS and IPs connected to the same person or company.

What Have I Been Pwned is

Have I Been Pwned (HIBP), created by Troy Hunt, is the best-known service for checking whether an email address appears in a data breach. It maintains a catalogue of breaches with descriptions, dates and the data types exposed, offers free email notifications when your address turns up in a new one, and lets organisations search breaches across a domain they have verified. Its Pwned Passwords service lets anyone check a password against hundreds of millions of breached passwords without sending the password, using a technique called k-anonymity. According to its API documentation, searching by email through the API requires a paid key, while the breach catalogue and Pwned Passwords are free to use, with breach data licensed CC BY 4.0.

How MyRecon uses HIBP

• Password checks. When you use our password tool, your browser hashes the password with SHA-1 and sends only the first five characters of the hash to Pwned Passwords. The match happens on your device. The password never reaches our servers.
• The Breach Files. Our breach archive is built from HIBP's public catalogue and credits it on every page, as the CC BY licence requires. What we add is severity scoring and written analysis of what each exposed field means for the person it belongs to.

For email searches we do not currently use HIBP's paid API. MyRecon combines two free sources, LeakCheck's public API and XposedOrNot, and reports distinct named breaches rather than raw leaked-row counts, so a single breach that leaked your address ten times is counted once.

Where Have I Been Pwned beats MyRecon

• The dataset. HIBP is the reference. Its breach loading is careful, well documented and widely trusted, and when a breach is newsworthy it is usually the first place people check.
• Notifications on the web. Register once and HIBP emails you when you appear in a new breach. Our alerts live in the Android app, compared on the handset so your address is never sent anywhere.
• Domain search. Security teams can see every address on their domain that appears in a breach. We do not offer that.
• A mature API. For developers integrating email breach checks, HIBP's API is the standard. We deliberately do not offer an email lookup API.

Where MyRecon goes further

• Two free breach sources in one answer. Useful as a cross-check, since no single breach index is complete.
• More than the breach. The same email shows its provider, whether it is disposable, whether a Gravatar is attached, and whether its domain's SPF and DMARC would stop someone forging mail from it. From there, one click runs the domain, the DNS records or a username.
• Written context. Our Case Files are long-form accounts of the landmark breaches: what happened, how, and what it changed.

"Unchecked is not clean"

One principle we hold everywhere applies here too. If a breach source fails to answer, MyRecon says the check was incomplete rather than showing a clean result. A green tick you did not earn is the most dangerous output a breach checker can give, because it is the one that stops you changing a password.

Which one should you use?

Sign up for Have I Been Pwned's free notifications. That is the single most useful thing on this page. Then use MyRecon when you want a second breach source, a password check with nothing sent, or when a breached address turns into a wider question about the accounts and infrastructure around it.

Questions people ask

Other comparisons