Data Breach Checker (Email & Password)

Verify if your email address or passwords have been exposed in public data leaks. Query hash prefixes anonymously without exposing your plain credentials.

Data Breach Checker (Email Leak Finder)

Check if your email address has been exposed in public data leaks. Inspect compromised parameters and secure your credentials before hackers can exploit them.

🛡️ Transparency & Safety Notice

What this tool shows:

It checks public databases to tell you exactly which websites leaked your email address, when it happened, and what type of information was exposed (e.g. Passwords, IP addresses, Names, or Phone numbers) so you know precisely what needs to be changed.

What this tool hides:

To prevent malicious use and protect your privacy, we never display actual decrypted passwords or raw account credentials. Password checks are performed using K-Anonymity SHA-1 hash ranges privately inside your browser.

How the Data Breach Checker Works

The Data Breach Checker (Email & Password Leak Finder) by DwellixTools is a free security utility designed to scan public databases of leaked credentials. It features two modes:

  1. Email Scanner: Searches the XposedOrNot database to identify if your email has been exposed in known third-party leaks. It prints a detailed timeline of compromised sites, exposed fields (e.g. passwords, addresses), and links to breach details.
  2. Password Scanner: Queries the Have I Been Pwned passwords list to verify if a password has been leaked. It performs the security checks 100% locally in your browser using a privacy-protecting model called K-Anonymity.

🔒 The K-Anonymity Password Safety Model

Many users are hesitant to type their passwords into an online leak checker. To solve this, our password scanner implements the K-Anonymity model, ensuring your actual password never leaves your browser.

Here is the exact step-by-step process of how your password is checked:

  1. Local Hashing: When you enter a password, the browser converts it into a SHA-1 hash (a 40-character hexadecimal string) using the built-in browser Web Crypto API.
  2. Hash Split: The hash is split into two parts:
    • Prefix: The first 5 characters (e.g. 21BD1).
    • Suffix: The remaining 35 characters.
  3. Prefix Query: The browser sends only the first 5 characters of the hash to the Have I Been Pwned range API (https://api.pwnedpasswords.com/range/21BD1).
  4. Range Match: The API responds with a list of all leaked password hashes that begin with that same prefix, along with their respective leak counts.
  5. Local Compare: The browser searches this list for your hash’s suffix. If a match is found, the count is shown. If not, the password is clean.

Because the API only receives the first 5 characters of the hash, it is mathematically impossible for anyone to intercept your password or know which specific password you searched for.

What to Do If Your Credentials Are Leaked

If either your email address or password is found in public data breaches, you should immediately take action to secure your digital identity:

  • Change Leaked Passwords: If you reuse passwords across multiple sites, hackers can exploit one compromised account to access others. Change the password on the breached service and any other accounts that share it.
  • Enable Multi-Factor Authentication (MFA): Two-factor authentication (using apps like Google Authenticator or hardware keys) ensures that even if a hacker has your password, they cannot access your account without your physical device.
  • Use a Password Manager: Generate strong, random, and unique passwords for every service and store them securely in a password manager.
  • Audit Account Sessions: Check active sessions on your email, social media, and financial accounts. Terminate any sessions you do not recognize.
  • Be Alert to Phishing: Cybercriminals use email leak indexes to target individuals with tailored phishing campaigns. Never click on link confirmations or input passwords in emails from unverified senders.

Feature Comparison: Email vs. Password Checkers

Specification Email Scanner Mode Password Scanner Mode
API Provider XposedOrNot Have I Been Pwned
Lookup Method Exact email search via first-party proxy 5-character SHA-1 range match
Client Privacy Proxied request to protect IP and queries 100% browser-only matching
Security Metric Number of leaks, site logos, data types Exact number of times leaked globally
Local Dev Support Requires Wrangler dev server (port 8788) Works on standard Dev server (port 4321)

Frequently Asked Questions (FAQ)

Is it safe to type my password into this tool?

Yes. Your password is never sent to any server in plain text. When you type a password, your browser generates a SHA-1 hash locally. Only the first 5 characters of this hash are sent to the Have I Been Pwned API. The API returns a list of matching hashes, and your browser completes the comparison locally.

If my email is found in a breach, has my computer been hacked?

No. An email breach means a website or service you registered with (such as Canva, Adobe, or LinkedIn) had its database compromised. Your personal computer or device itself is safe, but you should change the password of the compromised account immediately.

What is the difference between XposedOrNot and Have I Been Pwned?

  • XposedOrNot is a privacy-first data breach lookup service. We use it to check email addresses.
  • Have I Been Pwned is the industry standard database for leaked credentials, run by security expert Troy Hunt. We use it to verify password leak statuses.

What should I do if my password is found in a leak?

If your password has been leaked even once, you should stop using it immediately. Hackers run automated scripts (“credential stuffing”) trying leaked password and email combinations across thousands of popular websites. Use a password manager to generate a unique, strong password for every account.

How do I protect my email from future breaches?

Use unique passwords for every site, enable Multi-Factor Authentication (MFA), and consider using email aliases (like Hide My Email or Temp Mail) when signing up for services you don’t fully trust.