Privacy monitor

[Stephanie_Clark-Will]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:

Detailed description: I was using a Gmail account for years and it was hacked. I deleted the account, however, I’m sure that meant things have been attached to that email.

I believe there should be a way to query accounts with an old email address without signing into it, using my name and other identifiers.

Product & version number: Privacy monitor

OS details: Android

What is the error message you are seeing? I cannot enter an older email address, such as a Google address, without logging in. This account has been disabled however this account was hacked so I know there is a possibility that my personal identifier have been exposed using this email address.

If you have any supporting screenshots, please add them:

[bjm]

https://haveibeenpwned.com/
https://haveibeenpwned.com/Passwords

Yes — for most people, it is considered safe to enter an email address into Have I Been Pwned.
It’s a widely respected breach-checking service created by security researcher Troy Hunt and is recommended by many cybersecurity professionals.

Even though the HIBP password checker is widely trusted in the security community, it’s still best practice not to casually type highly sensitive passwords — especially your password-manager vault/master password — into random devices or public/shared computers.

For normal site passwords, though, the service is broadly considered legitimate and widely used.
A few practical points:

• An email address is already relatively public information on the internet.
• Entering only your email address there is generally low risk.
• You should never enter:
  • your vault/master password,
  • recovery phrases,
  • MFA backup codes,
  • or banking credentials.

For the /Passwords checker specifically, the site uses a privacy-preserving hash method so the full password is not sent in plaintext.

One thing to watch for:
There are fake lookalike domains. The real official site is exactly:
https://haveibeenpwned.com
—not variations like .to, .net, extra words, or typo domains.

AI sourced content may make mistakes

[peterweb]

Generally if you delete an email account, there is no way to access services that used that email for confirming it is you. Some sites would have offered you to set up additional methods of contacting you, such as a second email address or phone number for texting. This is done for security reasons, to help protect your accounts from get hacked, like your email account was.

You may be able to log into those sites using that older email address. But any interaction that required the site to send you an email will cause difficulties, or make it impossible to complete the transaction.