Troy Hunt
- Created Have I Been Pwned in December 2013
- Built Pwned Passwords, the breached-credential corpus with k-anonymity lookup
- Long-running security educator and Microsoft Regional Director
Bio
Troy Hunt created Have I Been Pwned in December 2013 as a way for people to find out whether their accounts appeared in a data breach. It now indexes billions of breached records, and its Pwned Passwords service is queried by password managers, identity platforms, and browsers.
Profile built from public project and press records.
Where their work shows up
NIST 800-63 tells you to screen new passwords against known-breached lists. Pwned Passwords is how most implementations actually do it, using a k-anonymity range query so the checking service never learns the password or its full hash. That single design choice made breached-credential screening safe enough to be a default, which is why it now sits inside CIAM platforms and password managers rather than being a security team's side project. See the breach teardowns for what the underlying data is drawn from.
Related on Start with Identity
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- GlossaryPassword Spraying
Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA. Spraying is designed to
- ExpertAuthor and Co-founder, IIW
Phil Windley is an author, researcher, and co-founder of the [Internet Identity Workshop](/conferences/iiw/). His book Learning Digital Identity is a widely use
- ExpertCo-founder, IDPro
Sarah Cecchetti co-founded IDPro and co-authored NIST SP 800-63-3C, the federation volume of the Digital Identity Guidelines. At AWS she led product for Amazon
- ExpertCo-founder, Internet Identity Workshop
Doc Searls co-founded the Internet Identity Workshop in 2005 with Kaliya Young and Phil Windley, and founded ProjectVRM at Harvard's Berkman Klein Center. He is