Have I Been Pwned is a free service created by Troy Hunt, allowing people to check if their email, phone number or passwords have been leaked in data breaches. The service has grown immensely in popularity over the years and the number of API requests with it, to the point that as of March 2022, Have I Been Pwned is serving over 1.6 billion requests per month for its Pwned Passwords API alone. Running as an Azure Function, serving data in the number of terabytes and requests in the billions is not cheap. For a free service, this is a problem that needs to be solved.

I'm going to show you how Have I Been Pwned uses Cloudflare to reduce the potential cost by over 90%, all while making things faster and more efficient at the same time. And the best thing is, most websites can apply similar techniques with the same benefits!