Is your email on the dark web? A free breach check, and a warning for addresses your site gives away

Published 2026-11-08

Stolen logins don't vanish. They get sold and swapped on the dark web and hacker forums, and the passwords in them get tried on other sites for years. Our free website score now has a breach check: type an email address or a password and see whether it has turned up in a known data breach.

Check an email address

We look the address up on Have I Been Pwned, the breach database run by Troy Hunt, and show every breach it is in, when it happened and what was taken. If passwords were in one, it says so, with what to do. We don't keep the address.

Check a password, without sending it

A password you type is hashed in your browser. Only the first five characters of that hash go to Have I Been Pwned, which answers with every leaked password hash that starts the same way, and your browser does the matching. Neither we nor they ever see the password. If it has been seen in a breach, stop using it everywhere.

Two new rows in the score

Data breaches says whether your domain is on Have I Been Pwned's list of breached services, so you know if your own users' data is out there.

Email addresses on show reads your home page and the contact and about pages it links to, and warns about every address written out in the page source. Some sites do this on purpose, but address harvesters read page source all day, and every address they find gets spam and phishing, from fake invoices to password-reset scams. A page listing many addresses, like a staff directory, hands them a ready-made list. We show the addresses masked, so the report can't be used to collect them. The fix is a contact form, or hiding the address from bots, which Cloudflare's Email Address Obfuscation does with one switch.

Dark Web Monitoring: keep watching

A check tells you about today. New breaches are added every week, so FrontierStack's Credential Leaks looks up your team's addresses on Have I Been Pwned every day, with your own key, and alerts you when one turns up in a new breach. KeyRotate's Guard does the same for the addresses you add, and also replaces API keys that leak.