diff --git a/src/api/core/mod.rs b/src/api/core/mod.rs
index 1638afe5..75c63c16 100644
--- a/src/api/core/mod.rs
+++ b/src/api/core/mod.rs
@@ -136,8 +136,8 @@ async fn put_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbC
 
 #[get("/hibp/breach?<username>")]
 async fn hibp_breach(username: &str, _headers: Headers) -> JsonResult {
+    let username: String = url::form_urlencoded::byte_serialize(username.as_bytes()).collect();
     if let Some(api_key) = crate::CONFIG.hibp_api_key() {
-        let username: String = url::form_urlencoded::byte_serialize(username.as_bytes()).collect();
         let url = format!(
             "https://haveibeenpwned.com/api/v3/breachedaccount/{username}?truncateResponse=false&includeUnverified=false"
         );