Data leak check: has your email been leaked?
See which known data breaches an email address appears in, when each one happened, and what kind of data leaked with it: passwords, phone numbers, postal addresses. The leaked values themselves are never shown.
By using these tools you accept the Terms and the Privacy page.
How the data leak check works
The data leak check looks up one email address in LeakCheck’s index of published data leaks. It shows where the address appeared, when, and what kind of data leaked with it, so you can decide which passwords to change and what kind of phishing to expect.
Reading the result
The summary has three levels. No leaks found means LeakCheck has no record of the address. Leaked means it appears in at least one leak, but no password came with it. Password leaked means at least one leak held a password, a password hash or a password salt for it.
Below that are four counts: the number of leaks, how many leaked records matched, the date of the newest leak, and whether a password was exposed. The table lists each named leak, newest first, with the month (or just the year) it happened and the kinds of data it held. A Password badge marks a leak that held a password, its hash or its salt, and Unverified marks a leak LeakCheck lists as unverified.
Compare the dates with when you last changed your passwords. A password you changed after a leak isn’t the one that leaked, but the old one still matters anywhere you reused it. Within 24 hours, checking the same address again shows the earlier answer and the time it was made, so a leak published in between appears only after that.
How much detail you get
You can paste an address with a display name, such as Jane <jane@example.com>, or a mailto: link; the check looks up the address inside it, in lowercase. It uses LeakCheck’s detailed lookup while zerobounce.ai’s allowance for it lasts. That answer lists the data types of each leak separately, and a leak that held nothing but the address says Email address only. After that, LeakCheck’s free public lookup answers instead. It names the same leaks and dates, but gives the data types for all of them together, in one line under the table. The provider field in the raw data says which one answered.
Each lookup has 20 seconds. The detailed lookup gets up to 12 of them; if it fails or runs out of time, the free lookup gets up to 10 seconds of what is left. If neither answers in time, the page says LeakCheck didn’t answer and nothing is saved, so the next try asks again. After 3 seconds of waiting, the page shows how long the search has been running.
What the data types mean
- Password, password hash and password salt set the result to “Password leaked”.
- Date of birth, phone number, postal address and postal code add a note that personal details were exposed, because they make phishing and scam calls more convincing.
- Website the login was for means the leak recorded which site a login belonged to.
- Other types, such as username, name, IP address or job title, are shown in plain words. A type the page doesn’t know is shown with LeakCheck’s own name for it.
Unnamed leaks and next steps
The summary says how many leaks were left unnamed. An unnamed leak still counts toward the password result and the list of data types, because those say what leaked, not where: if it held a password, the result says Password leaked even though the leak isn’t named. If no copy of the list of sensitive breaches can be loaded, every leak is counted and none is named; check again later to see the names. Each network can run 10 lookups a minute. After a password leak, make a new password with the password generator. To see whether the address can still receive mail, use the email address checker.
Updated · Maintained by Liviu Tanase
Questions
Where does the data come from?
From LeakCheck, which indexes published data leaks and breach collections (more than 10 billion records, by its own count). The check shows the name of each leak, when it happened and which kinds of data it held. It never shows the leaked values themselves.
What should I do if my address is listed?
If a password leaked, change it on every site where you used it, and turn on two-factor sign-in, starting with your email account. If only personal details leaked (name, phone, address, date of birth), expect more convincing phishing that quotes them. A password manager makes unique passwords easy.
Why are some leaks counted but not named?
Leaks from adult, dating and similar sites are counted but not named, because anyone can type any address here and naming those sites could expose something private about the owner. We use Have I Been Pwned’s list of sensitive breaches to decide, plus a keyword check.
Does a leak mean my email account was hacked?
Not by itself. It means a site that had your address lost data that included it. Your email account is at risk mainly when a leaked password is one you also use for email, so change that one first and turn on two-factor sign-in. The password generator makes a new password in your browser, and the full report runs this check together with the other email checks for the address.
Is this the same as Have I Been Pwned?
No. The search runs on LeakCheck’s index, so the list of leaks can differ from what Have I Been Pwned shows. Have I Been Pwned’s public breach list is used only to decide which leaks are sensitive; the address you check is never sent to it.
Why does the check take a few seconds?
An address that wasn’t checked in the last 24 hours is looked up live at LeakCheck, which can take several seconds. After 3 seconds the page counts the time; after 20 seconds the server stops and says LeakCheck didn’t answer, and nothing is saved, so you can try again a moment later. A repeat check within 24 hours answers from the saved result. To see whether the address still receives mail, use the email address checker.
My address isn’t listed. Am I safe?
It means LeakCheck has no record of it in the leaks it has indexed. Many breaches are never published, and new ones appear every week, so keep using unique passwords and two-factor sign-in.
Can I check a whole domain?
Not yet. Counting every leaked address at a domain needs a data plan that limits searches to the domain’s owner, so this check works one address at a time.
Who sees the address I check?
The address goes from our server to LeakCheck, which says it doesn’t store search queries. The answer, without any leaked values, is kept for 24 hours under a hash of the address so repeat checks don’t ask again. Your IP address isn’t sent to LeakCheck. The address you typed is kept in the page address so you can share the result.