Pwned Passwords Hits Record-Breaking Traffic: Over 17 Billion API Requests in 30 Days

In the fast-paced world of cybersecurity, one service has quietly become a cornerstone for protecting users worldwide: Troy Hunt’s Have I Been Pwned (HIBP) Pwned Passwords API. In May 2025, it shattered previous usage records, surpassing a staggering 17 billion API requests in just 30 days. This explosive growth underscores the rising awareness and reliance on password security tools, as individuals, enterprises, and developers increasingly check whether passwords have been compromised in past breaches. What makes this feat even more impressive is the technological backbone that supports it—Hunt credits Cloudflare’s edge network for handling the massive traffic efficiently, with a near-perfect cache hit ratio ensuring almost all requests are served in milliseconds.

the Pwned Passwords Milestone

Over the last month, the Pwned Passwords API has consistently served an average of 6,733 requests per second, with peak moments spiking to 42,000 requests per second in just one-minute intervals. The journey to this milestone has been marked by steady, almost exponential growth. Troy Hunt first announced passing 13 billion requests, averaging 5,027 requests per second, before reporting a consistent climb as the platform became a trusted source for both personal and enterprise security checks.

A key factor in the API’s scalability is Cloudflare’s edge caching, which served 99.99% of requests directly from edge nodes located milliseconds away from the end-user. This ensures lightning-fast responses and prevents overload on HIBP’s core servers. Interestingly, while HIBP provides open access to its dataset, Hunt notes that the service cannot track local mirrors or downloads, leaving only high-level statistics based on IP addresses and referrer headers.

The API’s popularity extends beyond simple curiosity. Users include developers integrating breach-checking into apps, enterprises enforcing password hygiene, and security-conscious individuals safeguarding their accounts. While some speculated that malicious actors could exploit the system to identify vulnerable targets, the open and transparent nature of the API, combined with strict logging policies, reduces such risk. Globally, the service continues to provide a critical layer of cybersecurity hygiene, helping ordinary users understand their exposure and encouraging stronger, unique passwords.

What Undercode Say: Deep Dive Analysis

The phenomenal usage of the Pwned Passwords API highlights several key trends in cybersecurity today. Firstly, awareness of data breaches is at an all-time high, with millions of users actively checking if their credentials have been compromised. This trend reflects a shift from reactive to proactive cybersecurity behavior, where users and organizations seek real-time verification tools. The API’s edge-serving strategy demonstrates the importance of modern content delivery networks (CDNs) in scaling services without sacrificing performance, especially when handling billions of requests.

From a technical standpoint, achieving a 99.99% cache hit ratio is remarkable. It implies that nearly every request is resolved without querying the origin server, showcasing the power of intelligent caching and efficient API design. It also emphasizes the value of geographically distributed edge nodes, reducing latency and improving user experience on a global scale.

Another insight is the API’s role as a freely accessible security resource, which contrasts sharply with commercial cybersecurity products. By allowing individuals and developers unrestricted access, HIBP fosters a culture of openness and shared responsibility. Yet, this openness also invites questions about misuse. While malicious actors could theoretically leverage the API to check for weak passwords, Hunt’s approach of not logging detailed usage and relying on aggregate analytics provides privacy-conscious safeguards.

Behavioral patterns reveal that many users leverage this tool for personal cybersecurity hygiene rather than corporate enforcement alone. With data suggesting that enterprise mirrors exist but aren’t fully tracked, it is evident that community-driven security practices are gaining traction alongside formal organizational policies. This democratization of breach intelligence represents a significant cultural shift in how cybersecurity knowledge is disseminated and applied.

Furthermore, the API’s growing popularity highlights the increasing interdependence of cloud infrastructure and cybersecurity tools. Without Cloudflare’s edge nodes and caching capabilities, sustaining billions of requests at sub-second latency would be infeasible. This reinforces the notion that scalable security solutions today must integrate deeply with high-performance cloud ecosystems.

Finally, the massive request numbers hint at an emerging metric of cybersecurity engagement. Just as social media measures influence through engagement, API traffic may become a proxy for public and enterprise commitment to password safety, offering new ways to gauge awareness and adoption rates. The trend also signals a potential pivot point for future cybersecurity innovations, where tools must combine transparency, scalability, and usability to maintain relevance in a rapidly evolving threat landscape.

Fact Checker Results

✅ API traffic exceeded 17 billion requests in 30 days.
✅ Cloudflare edge served 99.99% of requests, ensuring minimal latency.
❌ Detailed user-level statistics are not available due to privacy-focused logging policies.

Prediction

The skyrocketing demand for Pwned Passwords will likely continue, fueled by rising cybersecurity awareness and regulatory pressures on password hygiene. Expect API integration into enterprise security workflows to grow, alongside the development of more intelligent breach detection tools that combine real-time checks with proactive threat alerts. 🌐💡 Additionally, open-access tools like HIBP may set a new standard for community-driven cybersecurity, inspiring similar platforms for other digital hygiene metrics.