Free Email Breach Check: see which breaches an address appears in

What is an email breach check?

An email breach check tells you whether an address has turned up in a known data breach, and if so, how many and which sites. Breach data gets traded and republished long after the incident, so an address can sit in a dump for years without its owner ever hearing about it. The check reads that published record and returns the count, the named sites, and the dates.

The questions an email breach check answers:

• Has this address appeared in a known breach?
• How many separate breaches is it in?
• Which sites or services were breached?
• When was the earliest breach?
• When was the most recent one?
• Does the exposure still matter today?

The count on its own is a blunt signal. What matters is which sites and when. An address in one forum breach from 2013 is a very different risk from one in four breaches, the most recent of them last year, including a payment provider.

How an email breach check works

When you submit an address, the check runs four steps:

1. Format check. The address is validated first, so a typo comes back as a clear error rather than a clean result you might misread as good news.
2. Breach corpus match. The address is matched against published breach data, which returns the total number of separate breaches it appears in.
3. Site and date resolution. Where the record names them, the check returns the breached sites along with the first and last breach dates.
4. Response. Everything comes back in a single request, ready to read on screen or export as a CSV.

What an email breach check tells you

What each field tells you:

Breach count. The number of separate breaches the address appears in. One is common for any address that has been in use for years. Several suggests an address that is old, widely reused, and worth protecting more carefully.

Breached sites. The named services whose leaked data included this address. This is the part that tells you what was probably exposed, because a forum leak and a payment provider leak carry very different consequences.

First breach date. How far back the exposure goes. An address that leaked a decade ago has had plenty of time to circulate through credential lists.

Last breach date. How recent the most recent exposure is. Anything in the last year or two is worth a password rotation on the accounts tied to the address.

What it does not tell you. The check does not reveal passwords and does not confirm that an account is currently compromised. It tells you the address was present in data that leaked, which is a risk signal rather than a verdict.

No single field is the answer on its own. Read the count alongside the dates and the named sites to judge whether the exposure still matters.

Use cases for an email breach check

Assessing account-takeover risk: An address that appears in several recent breaches is a more likely target for credential stuffing, which matters when the same person signs in to your service. Heavy breach history is a reason to ask for a second factor rather than to refuse the account.

Screening signups: Flag new accounts opening on addresses with a long leak history, and step up verification for them. The same check runs programmatically through the API at signup time, so nothing has to be done by hand.

Checking your own exposure: Look up your own address to see what is already public. If it appears in recent breaches, change the passwords on the accounts tied to it and turn on two-factor authentication where it is offered.

Support and account recovery: When a user reports a takeover, the breach record is useful context for how their credentials were most likely obtained, and for deciding what else to ask them to reset.