HaveIBeenPwned

{
  "service_type": "platform",
  "base_url": "https://haveibeenpwned.com/API/v3",
  "auth_method": "api_key",
  "auth_config": {
    "header": "hibp-api-key",
    "type": "api_key",
    "paid": true,
    "free_tier_not_available": true,
    "notes": "API key required for the v3 API. Requires a paid subscription (starting at $3.50/month) from HaveIBeenPwned. For non-commercial, low-volume use, the UI can be used without an API key, but API access is paid."
  },
  "endpoints": [
    {
      "method": "GET",
      "path": "/breach/{name}",
      "description": "Get a single breach by name"
    },
    {
      "method": "GET",
      "path": "/breaches",
      "description": "Get all breaches (with optional domain filter)"
    },
    {
      "method": "GET",
      "path": "/pasteaccount/{account}",
      "description": "Get all pastes for a given account"
    },
    {
      "method": "GET",
      "path": "/pwnedpassword/{password}",
      "description": "Range-API not used here; direct check for single password (requires the password in plaintext, not recommended; use range endpoint instead)"
    },
    {
      "method": "GET",
      "path": "/pwnedpasswords/range/{first5hash}",
      "description": "Get list of password hashes matching the first 5 characters of SHA-1 hash; k-anonymity model"
    },
    {
      "method": "GET",
      "path": "/range/{first5hash}",
      "description": "Alias for the pwnedpasswords range endpoint (also supported)"
    }
  ],
  "pricing_model": {
    "type": "subscription",
    "details": {
      "monthly": "3.50 USD per month for first 5 active users, then tiered based on volume",
      "tiers": "Premium tiers based on number of active users and monthly requests",
      "free_tier": "No free tier for API v3; free access only to the website UI",
      "billing": "Paid via credit card, requires subscription through the HaveIBeenPwned website"
    }
  },
  "rate_limits": {
    "general_limit": "No explicit hard rate limit documented, but fair usage applies; exceeding limits may result in throttling or suspension.",
    "recommended": "For Pwned Passwords range endpoint, no API key is required and can handle high volume; for other endpoints, use modest rate (e.g., 1 request per 1.5 seconds) as used to be in previous v2.",
    "note": "Specific rate limit depends on subscription tier; higher tiers allow higher throughput."
  },
  "capabilities": [
    "Check if a password has been exposed in known data breaches",
    "Check if an email address or username has appeared in breaches",
    "Get list of all known breaches and their details",
    "Get pastes (from Pastebin etc.) containing an account",
    "Search by partial SHA-1 hash for password exposure (k-anonymity)",
    "Integrate with security tools (SIEM, password managers, etc.)",
    "API v3 requires OAuth or API key for most endpoints except Pwned Passwords range",
    "Supports domain search for breaches"
  ],
  "raw_analysis": "HaveIBeenPwned (HIBP) is a security-focused platform that aggregates data from thousands of data breaches and provides a repository of exposed passwords. It was created by Troy Hunt and has become the de facto standard for credential breach checking. The service offers a public website and a paid REST API (v3) that provides programmatic access to breach data, paste data, and the Pwned Passwords corpus.\n\nThe primary audience is security professionals, developers, and enterprises who want to integrate breach detection into their systems, such as password managers, authentication flows, or security monitoring tools. The platform is mature, having been around since 2013, and is widely trusted.\n\nKey features include the Pwned Passwords range API, which allows checking password exposure without revealing the full password (using k-anonymity). The API is rate-limited and requires a subscription for most endpoints, but the range endpoint for passwords is freely accessible without an API key and is designed for high-volume use.\n\nIntegrations exist with many password managers (e.g., 1Password, Firefox, Chrome) and security tools. The service is widely recommended by cybersecurity authorities.\n\nFor developers, the API v3 supports REST and requires an API key (via the 'hibp-api-key' header). Authentication is simple, but it's paid. There are no official SDKs but community wrappers exist. Documentation is clear and comprehensive.\n\nOverall, HIBP is a reliable and essential resource for password breach intelligence. It's highly mature and well-maintained. The pricing is reasonable for commercial use, though the lack of a free tier for API access might be a barrier for individual hobbyists, but the website and free range endpoint offer limited access."
}

1/3 tests passed

{
  "overall": 72,
  "dimensions": {
    "token_efficiency": 7.5,
    "first_try_success": 6.5,
    "response_parseability": 8.0,
    "error_clarity": 7.0,
    "doc_quality": 8.5,
    "auth_simplicity": 5.0,
    "latency": 6.0,
    "consistency": 8.0
  },
  "pricing_normalized": {
    "monthly_cost_usd": 3.50,
    "free_tier": false,
    "tier_based": true,
    "notes": "No free API tier; subscription required for API v3, but website UI free"
  },
  "issues": [
    "No free tier for API access, requiring paid subscription even for low-volume use",
    "OAuth/API key required for most endpoints, adding auth complexity for agents",
    "No robots.txt or llms.txt for automated discovery/parsing",
    "Latency slightly high (627ms) for typical API operations"
  ],
  "recommendations": [
    "Provide an official llms.txt to help agents discover API capabilities automatically",
    "Consider a free tier with rate limits to encourage adoption and testing",
    "Simplify auth with API key only option for simpler agent integration",
    "Optimize website latency to under 500ms"
  ]
}