Troy Hunt
Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals
- Posts
- 618 from 16 Jul 2015 to 27 Oct 2026
- Posting
- weekly (68 in the last year)
- Kind
- personal blog
- Feed
- https://www.troyhunt.com/rss/
2026 56
- Weekly Update 527: Cybergeddon News v. Reality
- Weekly Update 526: Building HIBP AI/SI First
- Weekly Update 525: AI Data Breach Hyperbole
- Weekly Update 524: Live From Copenhagen
- Weekly Update 523: Live From a Norwegian Fjord
- Weekly Update 522: Live From Oslo with Scott Helme
- Weekly Update 521: Breach Perception v. Reality
- Weekly Update 520: The Unscripted Edition
- Weekly Update 519: Breaches & Data Integrity
- A Cautionary Tale About Data Breach Claims, Verification and Carhartt
- Weekly Update 518: IoT Doorlock Nirvana with UniFi
- Welcoming the Sri Lankan Government to Have I Been Pwned
- Weekly Update 517: Cyber Ransoms
- Weekly Update 516: Live From Vietnam
- Welcoming the Nepalese Government to Have I Been Pwned
- Weekly Update 515: Seeking Caffeine Utopia
- Weekly Update 514: This Week in Data Breaches
- Weekly Update 513: Clauding The Home Network
- Weekly Update 512: IoT Lockout Fail
- Weekly Update 511: Live from my Riad in Marrakech
- Swimming Pools, Pee, and Trying to Delete Your Data From the Internet
- Weekly Update 510: Live From Mallorca with Scott Helme
- Weekly Update 509
- Weekly Update 508
- Weekly Update 507
- Welcoming the Philippine Government to Have I Been Pwned
- Weekly Update 506
- 1,000 Data Breaches Later, the Disclosure Lag is Worse Than Ever
- Welcoming the Bhutanese Government to Have I Been Pwned
- Weekly Update 505
- Weekly Update 504
- Welcoming the Bahamian Government to Have I Been Pwned
- Welcoming the Bangladesh Government to Have I Been Pwned
- Weekly Update 503
- Welcoming the Costa Rican Government to Have I Been Pwned
- Weekly Update 502
- Weekly Update 501
- Weekly Update 500
- Here's What Agentic AI Can Do With Have I Been Pwned's APIs
- Weekly Update 499
- Weekly Update 498
- HIBP Mega Update: Passkeys, k-Anonymity Searches, Massive Speed Enhancements and a Bulk Domain Verification API
- Weekly Update 497
- Weekly Update 496
- Weekly Update 495
- Weekly Update 494
- Weekly Update 493
- Weekly Update 492
- Weekly Update 491
- Weekly Update 490
- Weekly Update 489
- Weekly Update 488
- Weekly Update 487
- Weekly Update 486
- Who Decides Who Doesn’t Deserve Privacy?
- Weekly Update 485
2025 84
- Weekly Update 484
- Weekly Update 483
- Weekly Update 482
- Processing 630 Million More Pwned Passwords, Courtesy of the FBI
- Weekly Update 481
- Why Does Have I Been Pwned Contain "Fake" Email Addresses?
- Weekly Update 480
- Weekly Update 479
- Weekly Update 478
- Weekly Update 477
- 2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned
- Weekly Update 476
- How We (Almost) Found Chromium's Bug via Crash Reports to Report URI
- Weekly Update 475
- Inside the Synthient Threat Data
- Weekly Update 474
- Weekly Update 473
- Court Injunctions are the Thoughts and Prayers of Data Breach Response
- Weekly Update 472
- Welcoming CERN to Have I Been Pwned
- Weekly Update 471
- HIBP Demo: Querying the API, and the Free Test Key!
- Weekly Update 470
- Have I Been Pwned Demos Are Now Live!
- Weekly Update 469
- Weekly Update 468
- Weekly Update 467
- Home Assistant + Ubiquiti + AI = Home Automation Magic
- Weekly Update 466
- Weekly Update 465
- That 16 Billion Password Story (AKA "Data Troll")
- Get Pwned, Get Local Advice From a Trusted Gov Source
- Weekly Update 464
- Welcoming Guardio to Have I Been Pwned's Partner Program
- Weekly Update 463
- Weekly Update 462
- 11 Years of Microsoft Regional Director and 15 Years of MVP
- Good Riddance Teespring, Hello Fourthwall
- Weekly Update 461
- Welcoming Aura to Have I Been Pwned's Partner Program
- Weekly Update 460
- Welcoming Push Security to Have I Been Pwned's Partner Program
- Weekly Update 459
- Welcoming Truyu to Have I Been Pwned's Partner Program
- Weekly Update 458
- Weekly Update 457
- Weekly Update 456
- Weekly Update 455
- Weekly Update 454
- Weekly Update 453
- Have I Been Pwned 2.0 is Now Live!
- Weekly Update 452
- Welcoming the Malaysian Government to Have I Been Pwned
- Weekly Update 451
- After the Breach: Finding new Partners with Solutions for Have I Been Pwned Users
- Welcoming the Isle of Man Government to Have I Been Pwned
- Passkeys for Normal People
- Weekly Update 450
- The Have I Been Pwned Alpine Grand Tour
- Welcoming The Gambia National CSIRT to Have I Been Pwned
- Weekly Update 449
- You'll Soon Be Able to Sign in to Have I Been Pwned (but Not Login, Log in or Log On)
- Weekly Update 448
- Weekly Update 447
- Weekly Update 446
- Weekly Update 445
- A Sneaky Phish Just Grabbed my Mailchimp Mailing List
- Weekly Update 444
- Weekly Update 443
- Soft-Launching and Open Sourcing the Have I Been Pwned Rebrand
- Weekly Update 442
- We're Backfilling and Cleaning Stealer Logs in Have I Been Pwned
- Weekly Update 441
- Processing 23 Billion Rows of ALIEN TXTBASE Stealer Logs
- Weekly Update 440
- Weekly Update 439
- Weekly Update 438
- Weekly Update 437
- Weekly Update 436
- You Can't Trust Hackers, and Other Data Breach Verification Tales
- Weekly Update 435
- Experimenting with Stealer Logs in Have I Been Pwned
- Weekly Update 434
- Weekly Update 433
2024 75
- Weekly Update 432
- Weekly Update 431
- Weekly Update 430
- Weekly Update 429
- "Pwned", The Book, Is Now Available for Free
- Welcoming the Armenian Government to Have I Been Pwned
- Weekly Update 428
- Weekly Update 427
- Closer to the Edge: Hyperscaling Have I Been Pwned with Cloudflare Workers and Caching
- Weekly Update 426
- Inside the DemandScience by Pure Incubation Data Breach
- Weekly Update 425
- Weekly Update 424
- Weekly Update 423
- Weekly Update 422
- Weekly Update 421
- Weekly Update 420
- Weekly Update 419
- The Data Breach Disclosure Conundrum
- Weekly Update 418
- From Dreams to Reality: The Magic of 3D Printing, with Elle Hunt
- Weekly Update 417
- Weekly Update 416
- Weekly Update 415
- The North American Have I Been Pwned Tour
- Weekly Update 414
- The Trouble with Procurement Departments, Resellers and Stripe
- Weekly Update 413
- Inside the "3 Billion People" National Public Data Breach
- Weekly Update 412
- Weekly Update 411
- Begging for Bounties and More Info Stealer Logs
- Weekly Update 410
- MVP 14
- Weekly Update 409
- Weekly Update 408
- Weekly Update 407
- The State of Data Breaches, Part 2: The Trilogy of Players
- Weekly Update 406
- The State of Data Breaches
- Weekly Update 405
- Weekly Update 404
- Weekly Update 403
- Telegram Combolists and 361M Email Addresses
- Weekly Update 402
- Operation Endgame
- Weekly Update 401
- Have I Been Pwned Employee 1.0: Stefán Jökull Sigurðarson
- Weekly Update 400
- Weekly Update 399
- Weekly Update 398
- Weekly Update 397
- Weekly Update 396
- Weekly Update 395
- Weekly Update 394
- Weekly Update 393
- Weekly Update 392
- Inside the Massive Alleged AT&T Data Breach
- Weekly Update 391
- Welcoming the Liechtenstein Government to Have I Been Pwned
- Weekly Update 390
- Welcoming the German Government to Have I Been Pwned
- Weekly Update 389
- Weekly Update 388
- Thanks FedEx, This is Why we Keep Getting Phished
- Weekly Update 387
- Weekly Update 386
- Weekly Update 385
- How Spoutible’s Leaky API Spurted out a Deluge of Personal Data
- The Data Breach "Personal Stash" Ecosystem
- Weekly Update 384
- Weekly Update 383
- Inside the Massive Naz.API Credential Stuffing List
- Weekly Update 382
- Weekly Update 381
2023 70
- Weekly Update 380
- Weekly Update 379
- Weekly Update 378
- Weekly Update 377
- A Decade of Have I Been Pwned
- Weekly Update 376
- Weekly Update 375
- Weekly Update 374
- Acuity Who? Attempts and Failures to Attribute 437GB of Breached Data
- Weekly Update 373
- Hackers, Scrapers & Fakers: What's Really Inside the Latest LinkedIn Dataset
- Weekly Update 372
- Weekly Update 371
- Weekly Update 370
- Weekly Update 369
- Weekly Update 368
- Safe, Secure, Anonymous, and Other Misleading Claims
- Weekly Update 367
- Weekly Update 366
- Weekly Update 365
- Weekly Update 364
- Weekly Update 363
- 68k Phishing Victims are Now Searchable in Have I Been Pwned, Courtesy of CERT Poland
- Data From The Qakbot Malware is Now Searchable in Have I Been Pwned, Courtesy of the FBI
- Weekly Update 362
- Fighting API Bots with Cloudflare's Invisible Turnstile
- Weekly Update 361
- All New Have I Been Pwned Domain Search APIs and Splunk Integration
- Weekly Update 360
- Welcome to the New Have I Been Pwned Domain Search Subscription Service
- Weekly Update 359
- Weekly Update 358
- Weekly Update 357
- Weekly Update 356
- Lucky MVP 13
- Weekly Update 355
- Weekly Update 354
- Weekly Update 353
- Weekly Update 352
- Have I Been Pwned Domain Searches: The Big 5 Announcements!
- Weekly Update 351
- Weekly Update 350
- Weekly Update 349
- Weekly Update 348
- Weekly Update 347
- Weekly Update 346
- Divorce
- Weekly Update 345
- Weekly Update 344
- Join my Twitter Subscription for the Inside Word on Data Breaches
- Weekly Update 343
- Weekly Update 342
- Seized Genesis Market Data is Now Searchable in Have I Been Pwned, Courtesy of the FBI and "Operation Cookie Monster"
- Weekly Update 341
- Weekly Update 340
- Weekly Update 339
- Weekly Update 338
- To Infinity and Beyond, with Cloudflare Cache Reserve
- Weekly Update 337
- Weekly Update 336
- Down the Cloudflare / Stripe / OWASP Rabbit Hole: A Tale of 6 Rabbits Deep 🐰 🐰 🐰 🐰 🐰 🐰
- Weekly Update 335
- Weekly Update 334
- Pwned Passwords Adds NTLM Support to the Firehose
- Weekly Update 333
- Weekly Update 332
- Weekly Update 331
- Pwned or Bot
- Weekly Update 330
- Weekly Update 329
2022 76
- Weekly Update 328
- Weekly Update 327
- Weekly Update 326
- Weekly Update 325
- Weekly Update 324
- Weekly Update 323
- Get Pwned, for 30% Less!
- Data Breach Misattribution, Acxiom & Live Ramp
- Weekly Update 322
- Weekly Update 321
- The Have I Been Pwned API Now Has Different Rate Limits and Annual Billing
- Weekly Update 320
- Better Supporting the Have I Been Pwned API with Zendesk
- Weekly Update 319
- Big Changes are Afoot: Expanding and Enhancing the Have I Been Pwned API
- Weekly Update 318
- Weekly Update 317
- Weekly Update 316
- Weekly Update 315
- Weekly Update 314
- Weekly Update 313
- Weekly Update 312
- "Pwned", the Book, is Finally Here!
- Weekly Update 311
- Weekly Update 310
- Weekly Update 309
- Weekly Update 308
- Weekly Update 307
- Sending Spammers to Password Purgatory with Microsoft Power Automate and Cloudflare Workers KV
- Weekly Update 306
- Weekly Update 305
- If You're Not Paying for the Product, You Are... Possibly Just Consuming Goodwill for Free
- Weekly Update 304
- Weekly Update 303
- MVP Award 12
- Welcoming the Polish Government to Have I Been Pwned
- Weekly Update 302
- Understanding Have I Been Pwned's Use of SHA-1 and k-Anonymity
- Weekly Update 301
- Weekly Update 300
- Weekly Update 299
- Welcoming the Indonesian Government to Have I Been Pwned
- Weekly Update 298
- Weekly Update 297
- Downloading Pwned Passwords Hashes with the HIBP Downloader
- Weekly Update 296
- Weekly Update 295
- Weekly Update 294
- Weekly Update 293
- Weekly Update 292
- Weekly Update 291
- Breach Disclosure Blow-by-Blow: Here's Why It's so Hard
- Welcoming the North Macedonian Government to Have I Been Pwned
- Weekly Update 290
- Welcoming the Serbian Government to Have I Been Pwned
- Weekly Update 289
- Welcoming the Bulgarian Government to Have I Been Pwned
- Weekly Update 288
- Welcoming the Italian Government to Have I Been Pwned
- Weekly Update 287
- Weekly Update 286
- Setting the Bar for Government Access to Have I Been Pwned
- Building Password Purgatory with Cloudflare Pages and Workers
- Weekly Update 285
- Weekly Update 284
- I Wanna Go Fast: How Many Pwned Password Queries Can You Make Per Second?
- Weekly Update 283
- Welcoming the New Zealand Government to Have I Been Pwned
- How Everything We're Told About Website Identity Assurance is Wrong
- Weekly Update 282
- Weekly Update 281
- Weekly Update 280
- How I Got Pwned by My Cloud Costs
- Weekly Update 279
- Weekly Update 278
- Weekly Update 277
2021 95
- Weekly Update 276
- Weekly Update 275
- Open Source Pwned Passwords with FBI Feed and 225M New NCA Passwords is Now Live!
- Weekly Update 274
- When is a Scrape a Breach?
- Weekly Update 273
- A Password Manager Isn't Just for Christmas, It's for Life (So Here's 50% Off!)
- Weekly Update 272
- Weekly Update 271
- Weekly Update 270
- Merry #pwnedmas!
- Weekly Update 269
- Beg Bounties
- Weekly Update 268
- Weekly Update 267
- Weekly Update 266
- Pwned - The Collected Blog Posts of Troy Hunt (Preview)
- Weekly Update 265
- Weekly Update 264
- Weekly Update 263
- Weekly Update 262
- Weekly Update 261
- Weekly Update 260
- You Don't Need to Burn off Your Fingertips (and Other Biometric Authentication Myths)
- Welcoming the Czech Republic Government to Have I Been Pwned
- Weekly Update 259
- Weekly Update 258
- Weekly Update 257
- Hello CISO - Brought to You in Collaboration with 1Password
- Weekly Update 256
- Why No HTTPS? The 2021 Version
- Welcoming the Turkish Government to Have I Been Pwned
- Weekly Update 255
- 3D Printing with Kids on Lenovo Yoga 7i
- Weekly Update 254
- Weekly Update 253
- Your Work Email Address is Your Work's Email Address
- Weekly Update 252
- The Internet of Things is a Complete Mess (and how to Fix it)
- Welcoming the Israeli Government to Have I Been Pwned
- Weekly Update 251
- MVP 11
- Welcoming the Dutch Government to Have I Been Pwned
- Weekly Update 250
- Welcoming the Slovak Republic Government to Have I Been Pwned
- Weekly Update 249
- Welcoming the Jamaican Government to Have I Been Pwned
- Weekly Update 248
- Welcoming the Finnish Government to Have I Been Pwned
- Weekly Update 247
- Nameless Malware Discovered by NordLocker is Now in Have I Been Pwned
- Expanding the Have I Been Pwned Volunteer Community
- Welcoming the Uruguayan Government to Have I Been Pwned
- Weekly Update 246
- Welcoming the Belgian Government to Have I Been Pwned
- Welcoming the Dominican Republic Government to Have I Been Pwned
- Pwned Passwords, Open Source in the .NET Foundation and Working with the FBI
- Weekly Update 245
- Welcoming the Trinidad & Tobago Government to Have I Been Pwned
- Weekly Update 244
- Welcoming the Swedish Government to Have I Been Pwned
- Weekly Update 243
- Weekly Update 242
- Weekly Update 241
- Welcoming the Romanian Government to Have I Been Pwned
- Welcoming the Luxemburg Government CERT to Have I Been Pwned
- Data From The Emotet Malware is Now Searchable in Have I Been Pwned, Courtesy of the FBI and NHTCU
- Weekly Update 240
- Weekly Update 239
- Data Breaches, Class Actions and Ambulance Chasing
- Weekly Update 238
- Welcoming the Ukrainian Government to Have I Been Pwned
- I’m Writing a Book with Rob Conery, and It’s Gonna Be Awesome
- The Facebook Phone Numbers Are Now Searchable in Have I Been Pwned
- Weekly Update 237
- I Now Own the Coinhive Domain. Here's How I'm Fighting Cryptojacking and Doing Good Things with Content Security Policies.
- Weekly Update 236
- Weekly Update 235
- Weekly Update 234
- Home Assistant, Pwned Passwords and Security Misconceptions
- Weekly Update 233
- Gab Has Been Breached
- Welcoming the Portuguese Government to Have I Been Pwned
- Weekly Update 232
- Weekly Update 231
- Controlling Smart Lights Using Dumb Switches with Shelly and Home Assistant
- Weekly Update 230
- Weekly Update 229
- Here's How I Meet
- Weekly Update 228
- Creating a LaMetric App with Cloudflare Workers and KV
- Weekly Update 227
- Weekly Update 226
- Weekly Update 225
- Weekly Update 224
2020 98
- Weekly Update 223
- Weekly Update 222
- Weekly Update 221
- Weekly Update 220
- Weekly Update 219: IoT Unravelled with Scott Helme
- IoT Unravelled Part 5: Practical Use Case Videos
- IoT Unravelled Part 4: Making it All Work for Humans
- IoT Unravelled Part 3: Security
- IoT Unravelled Part 2: IP Addresses, Network, Zigbee, Custom Firmware and Soldering
- IoT Unravelled Part 1: It's a Mess... But Then There's Home Assistant
- Weekly Update 218
- Inside the Cit0Day Breach Collection
- Weekly Update 217
- Weekly Update 216
- If You Don't Want Guitar Lessons, Stop Following Me
- Weekly Update 215
- I've Joined the 1Password Board of Advisers
- Humans are Bad at URLs and Fonts Don’t Matter
- Weekly Update 214
- Weekly Update 213
- Customised Ubiquiti Clients and Randomised MAC Addresses on Apple Devices
- Weekly Update 212
- Welcoming the Canadian Government to Have I Been Pwned
- Hacking Grindr Accounts with Copy and Paste
- Weekly Update 211
- Weekly Update 210
- Weekly Update 209
- Padlocks, Phishing and Privacy; The Value Proposition of a VPN
- Weekly Update 208
- Weekly Update 207
- We Didn't Encrypt Your Password, We Hashed It. Here's What That Means:
- Weekly Update 206
- Weekly Update 205
- Weekly Update 204
- Weekly Update 203
- I'm Partnering with NordVPN as a Strategic Advisor
- I'm Open Sourcing the Have I Been Pwned Code Base
- Weekly Update 202
- Weekly Update 201
- Building the Ultimate Home Office (Again)
- How BeerAdvocate Learned They'd Been Pwned
- 10b
- Weekly Update 200
- Weekly Update 199
- A Decade of Microsoft Most Valuable Professional
- Weekly Update 198
- Sustaining Performance Under Extreme Stress
- Weekly Update 197
- Weekly Update 196
- Pwned Passwords, Version 6
- Weekly Update 195
- Microsoft Regional Director (Trifecta)
- Weekly Update 194
- The Unattributable "Lead Hunter" Data Breach
- Analysing the (Alleged) Minneapolis Police Department "Hack"
- Weekly Update 193
- Weekly Update 192
- Weekly Update 191
- The Unattributable "db8151dd" Data Breach
- Weekly Update 190
- Weekly Update 189
- COVIDSafe App Teardown & Panel Discussion
- Weekly Update 188
- Weekly Update 187
- Welcoming the Icelandic Government to Have I Been Pwned
- Let's Stop the 5G Hysteria: Understanding Hoaxes and Disinformation Campaigns
- Weekly Update 186
- No, I Won't Link to Your Spammy Article
- Reassuring Words and Good Intentions Don't Mean Good Security
- Weekly Update 185
- Weekly Update 184
- Welcoming the USA Government to Have I Been Pwned
- Coding With Ari, for Kids at Home
- Weekly Update 183
- There is a Serious Lack of Corporate Responsibility During Breach Disclosures
- Everything is Cyber-Broken, The Online Edition!
- Hack Yourself First Workshops in Australia, Denmark and Portugal (Virtually, of Course)
- Weekly Update 182
- Friends Don't Let Friends Use Dodgy WiFi: Introducing Ubiquiti's Dream Machine and FlexHD
- Weekly Update 181
- Enhancing Pwned Passwords Privacy with Padding
- Project Svalbard, Have I Been Pwned and its Ongoing Independence
- Weekly Update 180
- Handling Huge Traffic Spikes with Azure Functions and Cloudflare
- Weekly Update 179
- Weekly Update 178
- Donating BAT to Have I Been Pwned with Brave Browser
- Sharenting, BYOD and Kids Online: 10 Digital Tips for Modern Day Parents
- Weekly Update 177
- Weekly Update 176
- Weekly Update 175
- Kids and Code: Object Oriented Programming with Code Combat
- Weekly Update 174
- Welcoming the Danish Government to Have I Been Pwned
- Weekly Update 173
- The Difficulty of Disclosure, Surebet247 and the Streisand Effect
- Promiscuous Cookies and Their Impending Death via the SameSite Policy
- Weekly Update 172
2019 57
- Weekly Update 171
- When Is Data "Public"? (And 2.5M Public Factual Records in HIBP)
- Weekly Update 170
- Still Why No HTTPS?
- Weekly Update 169
- Generated Passwords, UX and Security Absolutism
- Weekly Update 168
- Weekly Update 167
- Welcoming the Swiss Government to Have I Been Pwned
- Weekly Update 166
- Teach Your Kids to Code with Ari in Oslo and London
- Data Enrichment, People Data Labs and Another 622M Email Addresses
- When Bank Communication is Indistinguishable from Phishing Attacks
- Welcoming the Norwegian Government to HIBP
- Weekly Update 165
- Weekly Update 164
- HSTS From Top to Bottom or GTFO
- Weekly Update 163
- Weekly Update 162
- Weekly Update 161
- Weekly Update 160
- Weekly Update 159
- Weekly Update 158
- Weekly Update 157
- Banks, Arbitrary Password Restrictions and Why They Don't Matter
- Weekly Update 156
- Weekly Update 155
- Weekly Update 154
- Weekly Update 153
- Weekly Update 152
- Extended Validation Certificates are (Really, Really) Dead
- Weekly Update 151
- Weekly Update 150
- Welcoming the Irish Government to Have I Been Pwned
- Weekly Update 149
- Weekly Update 148
- Authentication and the Have I Been Pwned API
- Weekly Update 147
- Pwned Passwords, Version 5
- Weekly Update 146
- Microsoft MVP Award, Year 9
- Welcoming the Austrian Government to Have I Been Pwned
- Weekly Update 145
- Weekly Update 144
- Weekly Update 143
- Hack Yourself First - The UK Tour by Scott Helme
- Project Svalbard: The Future of Have I Been Pwned
- Weekly Update 142
- Weekly Update 141
- Weekly Update 140
- PayPal's Beautiful Demonstration of Extended Validation FUD
- Weekly Update 139
- Weekly Update 138
- Weekly Update 137
- Weekly Update 136
- Weekly Update 135
- How to Track Your Kids (and Other People's Kids) With the TicTocTrack Watch