Project Svalbard, Have I Been Pwned and its ongoing independence (troyhunt.com)

Article summary

The founder of Have I Been Pwned (HIBP) has decided not to sell the service after an 11-month process, citing concerns over the potential buyer's vision and his own independence. The process involved 141 companies and a significant amount of time and resources. The founder will continue to run HIBP independently, prioritizing the trust and sustainability of the service. The experience has given him clarity on what he wants for the future of HIBP.

Main themes

• independence and control
• trust and reputation
• M&A process
• non-profit vs for-profit
• sustainability and growth
• valuation and pricing

What commenters say

• Some commenters believe that HIBP's value lies in the trust placed in its founder, and that selling the service would compromise this trust.
• Others think that the founder should consider operating HIBP as a non-profit utility, similar to Let's Encrypt.
• A few commenters suggest that the founder could leverage HIBP's marketing presence to build a security SaaS company or launch a consultancy.
• Some argue that the process of selling a small, independently run website like HIBP is overly complex and costly, and that using a big 4 consulting firm like KPMG may not be the most cost-effective option.
• There is disagreement over whether the founder's decision not to sell HIBP is a good one, with some seeing it as a principled move and others as a missed opportunity.
• Some commenters think that the founder's goal of maintaining independence and control over HIBP is admirable, but may not be realistic or sustainable in the long term.
• Others believe that HIBP's value is not just in its data, but in the trust and reputation of its founder, and that this is difficult to put a price on.