Email breach check

See if an email address has shown up in a known data breach

We check the email against an aggregated database of known data breaches. We don't store the email address you enter — it's only used for this one lookup.

Found in a breach — what to do

  1. Change the password on the breached site, and on every other site where you used the same or a similar password.
  2. Use a password manager so each site gets its own password.
  3. Turn on two-factor authentication, starting with email, banking and Microsoft / Google accounts.
  4. Expect targeted phishing: attackers use breached data to write convincing emails that mention a real account or order.

Old breaches show up too

Breach databases keep historic leaks, so an address may appear in breaches from years ago. That isn’t a new incident — but if the password from back then is still in use anywhere, change it.

Where the results come from

The address is checked against XposedOrNot, with LeakCheck and Have I Been Pwned as fallbacks. Each database has different coverage, so “not found” means not in the breaches they know about — not that the address has never leaked.

To test a password itself without sending it, use the Password breach check.