What Is a Paste in Have I Been Pwned?
A paste in Have I Been Pwned means your email address was found in a block of text published on a public sharing site, such as Pastebin, rather than in a database taken from one named company. Treat it as a sign your address is circulating in leaked lists, and secure the accounts that use it.
Most results in Have I Been Pwned point to a named company breach. A paste result looks different: instead of a company name, it refers to a paste, a block of text that someone published online.
What a paste is
Paste sites let anyone publish plain text and share it with a link. Leakers have long used them to post lists of email addresses taken from breaches. Have I Been Pwned loads email addresses from these pastes, most of them from Pastebin, and a single paste usually holds anywhere from dozens to thousands of addresses.
How a paste differs from a breach
- A breach is tied to a specific service whose data was exposed, so you know which account is affected.
- A paste is a public dump of text. It may not say where the addresses came from, so the original service is often unclear.
- Both mean your address has been circulating outside the service you gave it to.
What a paste result means for you
A paste does not prove that a particular account was hacked. It does mean your email address was on a list that someone chose to publish, which often points back to an earlier breach and makes the address a likely target for spam and phishing.
What to do next
- Change the password on your email account, and on any other account where you used the same password.
- Turn on two-factor authentication for your email and financial accounts.
- Be extra careful with messages that mention services you use, since they may be phishing.
- Sign up for breach notifications so you hear about future pastes and breaches involving your address.
Why paste results are less visible now
In 2017, Have I Been Pwned stopped publicly listing recent pastes, because the list made leaked data easier to find. Pastes are still loaded, and people whose address appears in one are notified.
Sources
- Troy Hunt: Pastes on Have I Been Pwned are no longer publicly listed (1 Aug 2017)
- Have I Been Pwned: Frequently Asked Questions
Related Have I Been Pwned guides
If you want to investigate exposure beyond known breach records, start with the Digital Footprint Checker for a broader view of your online exposure.
Related Reading
- Have I Been Pwned Says No Breaches: Am I Safe?
- Have I Been Pwned India: Check If Your Email Was Leaked
- Is Have I Been Pwned Safe to Use? Email Privacy Explained
Frequently Asked Questions
Bottom line
A paste result means your email address was published in a public text dump. Treat it like a breach of unknown origin: secure the accounts that use that address and stay alert for phishing.
See if your email has already leaked
Check my email free →- Checks your email against known data breaches
- Shows which sites leaked it, and when
- Shows what leaked: passwords, phone, address
- Result on screen in about 30 seconds
- We don't store the email you check