This talk was recorded at NDC Copenhagen in Copenhagen, Denmark. #ndccopenhagen #ndcconferences #developer #softwaredeveloper    

Attend the next NDC conference near you: 
https://ndcconferences.com
https://ndccopenhagen.com/

Subscribe to our YouTube channel and learn every day:   
/        @NDC 

Follow our Social Media!

https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences/

#cloud #dotnet #security #serverless 

Over 12 billion requests per month, over a terabyte of data being constantly queried, paying subscribers, public APIs, unpredictable throughput patterns, constant uptime requirements and a never ending stream of data breaches. That's the challenge of running Have I Been Pwned on a day-to-day basis.

There must be a pretty big team of developers and SREs?

Yep, two people!

Wait what?! How is that possible?

In this talk I'll show you what it takes to run Have I Been Pwned, it's architecture, what technology it is using and how to bring out the best in the infrastructure and frameworks used to run it. I'll also go over some learnings and gotcha's that we had to figure out, sometimes the hard way.

NDC Conferences

Have I Been Pwned now handles 17 billion monthly requests across 15+ billion breached accounts with a three-person team. The service evolved from Azure Tables to Azure SQL Hyperscale, implementing Cloudflare CDN with cache reserve for 99.9999% cache hit rates, custom autoscaling to work around Azure's memory-based billing quirks, and edge processing with Workers to reduce latency to under 50ms globally. Key lessons include the importance of observability, proactive monitoring over reactive dashboards, understanding database parallelism settings (max DOP), and how performance improvements can expose hidden bottlenecks.

Adventures at HyperScale! - Stefán Jökull Sigurðarson - NDC Copenhagen 2025