Troy Hunt

The Australian security researcher who launched Have I Been Pwned on 4 December 2013, the free service that tells anyone whether their email address has appeared in a known data breach, and who writes about breaches at troyhunt.com.

Hunt built the service after the Adobe breach, at the time the largest single breach of customer accounts, because he kept finding the same accounts exposed over and over, often with the same passwords. Its companion, Pwned Passwords, checks whether a password has already been exposed, and law enforcement agencies including the FBI and Europol contribute credentials found in their investigations. Before going independent he spent fourteen years at Pfizer, and from 2013 he wrote 47 security courses for Pluralsight; in 2017 he testified before the US House Committee on Energy and Commerce on proving identity once so much identity data has already leaked. He holds Microsoft's Regional Director title, which he describes as a recognition rather than a job.

Have I Been Pwned went live on 4 December 2013, and the next day Hunt was already blogging about how he made searching 154 million records fast, the first of what became, by the service's tenth birthday, 185 posts about building and running it. Pwned Passwords followed on 3 August 2017 with 306 million breached passwords that anyone could download and use to refuse a password criminals already hold. Version 2, on 22 February 2018, held 501,636,842 unique passwords and introduced the range search he built with Junade Ali of Cloudflare, in which a client sends only the first five characters of a password's SHA-1 hash and finishes the comparison itself.

On 30 November 2017 he testified before the US House Committee on Energy and Commerce on proving identity once so much identity data has already leaked. In 2018, after more than 100 hours of Pluralsight content, he moved on to HIBP and public engagements full time. On 11 June 2019 he announced Project Svalbard, a search for a new home for the service run with KPMG's mergers and acquisitions practice; on 3 March 2020 he announced that HIBP would stay independent, because after 11 months the party expected to buy it changed its business model and the deal became infeasible.

On 7 August 2020 he announced that he would open source the HIBP code base, and on 28 May 2021 Pwned Passwords became open source under the .NET Foundation, with the FBI feeding in compromised passwords found in its investigations. He runs the service from the Gold Coast in Australia with Charlotte Hunt, HIBP's chief operating officer.

Also known as: troy hunt, hibp founder, troyhunt.com

Sources

← All glossary entries