Companies Using Have I Been Pwned

Our crawler reads the TXT records of every domain in the index, and Have I Been Pwned's is one of the most common security records it finds. A domain counts when a TXT record contains have-i-been-pwned-verification. Our October 2026 crawl puts that at 18,411 domains, 15,460 matched to a company, 3rd of 17 in Security Testing & Compliance. When I re-read the 18,189 domains in our clean set on 15 October, 18,095 still had the record. The signal is solid. It's also older than it looks.

What the record proves

Have I Been Pwned's domain search lists the breached email addresses on a domain, and its support article says verification proves you control the domain before you can search its breach data. There are four methods: a DNS TXT record, a meta tag, an HTML file or an email to an admin address. Each domain is verified separately, and a root domain doesn't cover its subdomains. So the record means someone at the company, or someone it trusted with its DNS, wanted to see which of its addresses had leaked.

Sales signal: a company with this record has already looked at its breach exposure. It's a warm lead for password managers, multi-factor authentication and phishing training, the fixes that list tends to prompt.

The record it no longer issues

Newer verifications use a shorter record, hibp-verify, which mpg.de and t3.nz both carry. Our rule matches only the older name. To size the gap I dug 13,163 domains that had verified with Wiz, Detectify, AbuseIPDB or SpyCloud: 427 carried the old record and 95 only the new one. In that population about 18% of Have I Been Pwned verifications were invisible to us, and the share can only rise as new sign-ups use the new record.

"Our Have I Been Pwned count is a list of earlier verifiers. Nearly one verifier in five on the security-conscious domains we checked uses the newer record, and our rule can't see it yet." - David Thomson, CTO at TechnologyChecker.io

Sales signal: the list skews towards companies that verified a while ago. Treat a missing record as unknown, not as a no, and expect the newest domain-search users to be under-represented until the rule is updated.

Whose verification is it?

Unlike Wiz or Detectify, Have I Been Pwned issues a fresh value per domain, so I can't group the list by account. The 18,095 domains carry 18,734 different values, and only a few repeat. One value sits on 60 small French business sites and another on 13 Spanish ones, which looks like a web agency copying a single record into every client's DNS. That's about 0.4% of the count. What DNS can't show is the managed-service provider who verifies client domains under its own login. IT Services and IT Consulting is the top industry at 9.96%, and the sample I opened included several small IT support firms.

Sales signal: the IT-services rows are worth more than their count. Each provider may be watching dozens of client domains, so they're a channel, not a single seat.

A sticky record

The chart moves from 15,740 domains in June to 18,411 in October. That mostly tracks our crawl: the domains we cover turn over every month as dead sites leave and new ones are found, and our DNS detection widened over those months. Removals are rare. 207 domains dropped the record since 16 March 2026, 20 still carry it on another hostname, and 157 of the 212 dropped hostnames had really removed it when I re-checked.

Sales signal: about 1% of domains drop the record in seven months. Whatever the subscription status, the record stays, so don't use it to time a renewal pitch.

Small, established, everywhere

73.63% of matched companies with a known size have 200 staff or fewer and 50.03% have 50 or fewer. The free tier, which covers domains with 10 or fewer breached addresses, makes that easy to understand. They're established firms rather than startups: 13.84% were founded before 1960 and only 4.98% in the 2020s. No industry passes 10%, and after IT services come Software Development (5.54%), Financial Services (3.7%) and Construction (3.11%). 1,484 companies have more than 1,000 staff, including Costco, Novartis, BAE Systems, Goodyear and LEGO.

Sales signal: this is a list of ordinary businesses that took one free security step. That makes it a good top-of-funnel list for SMB security, and a poor proxy for security budgets.

A Commonwealth lean

The United States has 4,255 matched companies, the United Kingdom 2,051 and Australia 1,639, more than Germany (1,141) or Canada (746). Together the UK, Australia, New Zealand and Canada reach 4,713, ahead of the US alone. On Wiz's page, Australia has 86 matched companies against 1,246 American ones; here it has more than a third of the American figure.

Sales signal: for an Australian or New Zealand security pitch, this list is unusually deep: 1,916 matched companies across the two countries.

Overlap, not switching

We publish no migration table. The big overlap is KnowBe4: 936 domains run both today, out of 948 ever seen with both. That's 5.15% of the 18,189 clean domains. A company checks which addresses leaked, then trains the people behind them; the two records sit side by side.

"Have I Been Pwned tells a company which addresses leaked. KnowBe4 trains the people behind them. On 936 domains they arrive together." - David Thomson, CTO at TechnologyChecker.io

Sales signal: the 936 domains with both records have a security programme beyond the free tier. They're the best part of this list for paid identity and credential-monitoring tools.

The stack around it

On the clean set, WordPress runs on 42.26%, Google Analytics on 62.34% and Cloudflare on 48.61%. 1Password's verification record is on 4.58%, Duo Security on 2.45% and NordPass on 0.42%. Cloudflare Browser Insights (11.65%) and Matomo (4.92%) show a technical minority.

Sales signal: only about 5% carry 1Password's or NordPass's record. On a list of companies that already checked their breach exposure, that's the obvious gap.

What it costs

The pricing page lists Core plans from $4.39 a month for one domain of up to 25 breached addresses to $319 for 20 domains, and Pro plans from $379 to $4,599 a month for 50 to 800 domains. Domains with 10 or fewer breached addresses are free.

Sales signal: the plans count domains, so an IT provider watching many client domains needs one of the larger tiers. Look for those providers first.

Key takeaways

1. 18,411 domains in October 2026, 3rd of 17; each verified a domain for breach search at least once.

2. Newer verifications use hibp-verify, which our rule misses, about 18% of verifiers on the domains we tested.

3. 73.63% of matched companies have 200 staff or fewer; IT services lead at 9.96%.

4. Australia (1,639) is third by country.

5. 936 domains also run KnowBe4.

How to use this list

Treat each row as a past verification, flag the IT-services firms as possible channels, and expect recent sign-ups to be missing. Our DNS statistics report explains why we read TXT records as history. The full list of 18,411 domains, with 15,460 matched companies and their size, country and industry, is on TechnologyChecker.io.