Data leak check
See which known data leaks an email address appears in, when each one happened, and what kind of data leaked with it: passwords, phone numbers, postal addresses.
Questions
Where does the data come from?
From LeakCheck, which indexes published data leaks and breach collections (more than 10 billion records, by its own count). The check shows the name of each leak, when it happened and which kinds of data it held. It never shows the leaked values themselves.
What should I do if my address is listed?
If a password leaked, change it on every site where you used it, and turn on two-factor sign-in, starting with your email account. If only personal details leaked (name, phone, address, date of birth), expect more convincing phishing that quotes them. A password manager makes unique passwords easy.
Why are some leaks counted but not named?
Leaks from adult, dating, health and similar sites are counted but not named, because anyone can type any address here and naming those sites could expose something private about the owner. We use Have I Been Pwned’s list of sensitive breaches to decide, plus a keyword check.
My address isn’t listed. Am I safe?
It means LeakCheck has no record of it in the leaks it has indexed. Many breaches are never published, and new ones appear every week, so keep using unique passwords and two-factor sign-in.
Can I check a whole domain?
Not yet. Counting every leaked address at a domain needs a data plan that limits searches to the domain’s owner, so this check works one address at a time.
Who sees the address I check?
The address goes from our server to LeakCheck, which may keep a record of searches. It is sent in the body of the request, not in the page address. The answer, without any leaked values, is kept for 24 hours under a hash of the address so repeat checks don’t ask again. Your IP address isn’t sent to LeakCheck.