Know what's been pwned.
A complete, AOT-compatible client for Have I Been Pwned, with clean interfaces and privacy-first password checks.
// The plaintext never leaves your process.
var pwned = await passwordsClient
.GetPwnedPasswordAsync("P@ssw0rd!");
if (pwned.IsPwned is true)
{
logger.LogWarning(
"Seen {Count:N0} times in breaches.",
pwned.PwnedCount);
}dotnet add package HaveIBeenPwned.ClientOne package. Four ways to see exposure.
Breach intelligence
Search an account, browse the full breach catalogue, and inspect the data classes exposed in each incident.
Pwned passwords
SHA-1 or NTLM range queries. The plaintext stays on your machine.
PasswordsDomains & stealer logs
Verify domains over DNS or email, then search exposure by address.
DomainsTelemetry, ready to wire
A stable ActivitySource and Meter drop straight into your existing OpenTelemetry pipeline.
The password check that never sends the password.
K-anonymity means the SDK hashes the password in your process, sends only five SHA-1 characters, then finds the match locally.
Explore password checks••••••••••••Ready to protect the password.
- Inside your processHash the password
21BD12DC183F...A757 - Across the networkRequest the range
GET /range/21BD1 - Anonymous responseReceive a suffix bucket800+ suffixes
- Back inside your processCompare locally
suffix match
One registration. Every client.
Add the services once. Resolve a focused interface where you need it, or the aggregate IPwnedClient when an integration touches the whole API.
builder.Services.AddPwnedServices(options =>
{
options.ApiKey = builder.Configuration["HibpOptions:ApiKey"];
options.UserAgent = "my-service/1.0";
});
// Resolve a focused client, or the aggregate IPwnedClient.
var breaches = app.Services
.GetRequiredService<IPwnedBreachesClient>();The full client with focused interfaces and sensible defaults.
Contracts and models for clean dependency boundaries.
Resilience with retry-after, jitter, and circuit breaking.
Failures stay honest.
Documented 404 responses map to each operation's no-result shape. Everything else throws a PwnedApiException you can inspect. Cancellation and transport errors never turn into empty success.
Ship breach checks this afternoon.
Focused interfaces, privacy-first helpers, and resilience that behaves. Start with the reference.