A data leak checker looks through known leaks and breaches for your email address. It tells you which ones contain it, what leaked in each, and when it happened. XposedOrNot checks 11.7 billion records across 797 breaches, free, without an account.
- 797 breaches
- 11.7 billion records
- 763 verified
What is a data leak?
A data leak is private information ending up where it should not be. Nobody has to break in. A company leaves a database open on the internet, or sends a file to the wrong place, and the data is out.
A data breach is the break-in version: someone gets into a system and takes the data.
For you the result is the same. Your details are in a file that strangers can read, so this checker covers both.
What a data leak check shows you
For each leak that contains your email, you see four things:
- Where it came from: the company or service.
- When it happened.
- What leaked with your email: passwords, phone number, address and so on.
- How risky the passwords are: plain text, easy to crack or hard to crack. "Unknown" means we could not confirm how they were stored, so treat the password as exposed.
You do not see the leaked data itself. We do not show anyone's password or documents, including your own.
What usually leaks: our catalog in numbers
Out of 797 leaks and breaches we index, this is how many exposed each kind of data.
| What leaked | Number of breaches |
|---|---|
| Email addresses | 797 |
| Passwords | 518 |
| Names | 421 |
| Usernames | 396 |
| Phone numbers | 285 |
| IP addresses | 276 |
| Physical addresses | 227 |
| Dates of birth | 201 |
| Government IDs | 17 |
Passwords leaked in about two out of three. In 83 of them the passwords were stored as plain text, readable by anyone holding the file.
Phone numbers leaked in about one in three, and home addresses in more than one in four. That is why a leak often shows up later as scam calls and letters, not only as spam.
More breakdowns are on our repository page.
Stealer logs: the leak that comes from your own device
Not every leak comes from a company. A stealer log comes from malware on a person's own computer, which copies the passwords saved in the browser and sends them to a criminal.
We index stealer-log data too, and it is included in every check for free. One set alone, AlienStealerLogs, holds 299,646,818 email addresses.
If your email shows up in a stealer log, treat the device as unsafe. Scan it for malware first, then change your passwords from a different device.
Leak check: what to do in the first hour
Tick each step when it is done, or when it does not apply to you.
0 of 5 steps done
Step-by-step advice for each kind of leaked data is on the data breach check page.
Where the leaked data comes from
The data comes from leaks and breaches that have been made public, or that reach us through our sources. Each one is checked against a statement from the company or press coverage before it is added, and each entry names its source.
Some record counts come straight from the leaked file and can be incomplete. Leaks that were never made public cannot be indexed, so a clean result is good news, not a guarantee.
The full process is on our methodology page.
Common questions about leak checks
What is a data leak?
A data leak is private information being exposed without anyone breaking in, for example a database left open on the internet. A data breach is when someone breaks in and takes it. Both put your details in strangers' hands.
How do I check if my data was leaked?
Enter your email address in the box at the top of this page. You will see each leak or breach that contains it, with the date and what leaked. It takes a few seconds and needs no account.
Is this data leak check free?
Yes. There is no charge and no account, and checking more than one address costs nothing either. Stealer-log data is included at no cost.
What is the difference between a data leak and a data breach?
A breach is a break-in: someone gets into a system and steals data. A leak is an exposure: data is left open or sent to the wrong place. This checker covers both, because the risk to you is the same. Our data breach check page covers the breach side in more depth.
Where does the leaked data come from?
From leaks and breaches that have been made public or shared with us, each checked before it is added. Today 763 of 797 entries carry the Verified tag. The methodology page explains the process.
Do you store my email?
No. The email addresses people search for are not stored, and there is no search log. The only time we keep an address is when you sign up for alerts, and that needs you to confirm by email first.