pwned.client
All API docs

Pastes

Find public pastes that reference an email address. Pastes are text dumps posted to sites like Pastebin. This is an authenticated surface.

Inject in DI
  • IPwnedPastesClientRetrieves paste records for a given account.

Inject IPwnedPastesClient. Requires an API key on HibpOptions.ApiKey.

RegistrationC#
using HaveIBeenPwned.Client;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddPwnedServices(options =>
{
    options.ApiKey = builder.Configuration["Hibp:ApiKey"];
    options.UserAgent = "MyApp/1.0";
});

var app = builder.Build();

GetPastesAsyncAPI key

Returns every paste that includes the given email address, most recent first. Returns an empty array when none are found.

GEThaveibeenpwned.com/api/v3/pasteaccount/{account}Request detailsHide details
HTTP requestHTTP/1.1
GET /api/v3/pasteaccount/{account} HTTP/1.1
Host: haveibeenpwned.com
Accept: application/json
hibp-api-key: ••••••••••••
AuthenticationAPI key

The SDK reads the configured key and adds the hibp-api-key header for this request.

Response bodyJSON

The SDK deserializes the response into the documented .NET return type.

Official HIBP reference 
Task<Pastes[]> GetPastesAsync(
    string account,
    CancellationToken ct = default)
Parameters
NameTypeDescription
accountrequiredstringEmail address to search. Trimmed and URL encoded for you.
ctCancellationTokenSignals cancellation.
Returns
Task<Pastes[]>Paste records, or an empty array when the account appears in none (HTTP 404).
StreamsAlso available as GetPastesAsAsyncEnumerable for IAsyncEnumerable consumption.
Example usageC#
Pastes[] pastes = await pastesClient.GetPastesAsync("account@example.com");

foreach (var paste in pastes)
{
    Console.WriteLine($"{paste.Source}/{paste.Id}: {paste.EmailCount} emails.");
}

Running the snippet above prints:

Sample outputtext
Pastebin/8Q0BvKD8: 139 emails.
AdHocUrl/example: 42 emails.
Exceptions
TypeThrown when
ArgumentNullExceptionaccount is null, empty, or whitespace.
PwnedApiExceptionAny non-success status other than 404.
Status codes
CodeMeaning
200Pastes found.
401Missing or invalid API key.
404No pastes for the account. Returned as an empty array.
429Rate limit exceeded. The Retry-After header is surfaced on PwnedApiException.RetryAfter.
503Service temporarily unavailable. Retried by the resilience pipeline when configured.
Privacy note

Never log or export plaintext passwords. K-anonymity range results that do not match the requested value must not be retained.