Free Domain Breach Monitoring, No Size Limits
Monitor every email address on your domain. When your employees' addresses appear in a newly indexed data breach, you get an email automatically. No dashboards to babysit, no per-address pricing, no tiers, no credit card.
Free. Unlimited. Automatic.
Setup takes minutes with email, DNS, or HTML verification.
How it works
Verify your domain
Prove ownership your way: a verification link sent to a standard address on the domain (the easiest option), a DNS TXT record, or an HTML tag or file on your website. Only domains you control can be monitored, and the monitoring email must be an address on the domain itself.
We watch, continuously
Every new breach indexed by XposedOrNot is checked against your domain, across 776 breaches and more than 11.5 billion records, stealer logs included. How breaches enter the database is documented in the methodology.
You get alerted automatically
When your domain appears in a newly indexed breach, an alert email goes out and the breach shows up in your dashboard's real-time alerts with severity and affected count. A quarterly summary report keeps you covered even when nothing happened. Set it once and forget it.
Whether you have 10 employees or 50,000, it's free
Most breach monitoring services price domain monitoring by the number of addresses on the domain. XposedOrNot doesn't. Every verified domain gets full monitoring, automatic alerts, and full breach history at no cost, regardless of size.
What you get after verification
- Automatic breach alerts to your monitoring address, plus a real-time alerts view with breach name, severity, affected count, and acknowledgment tracking.
- Exposure overview: monitored domains, exposed emails, and exposed records at a glance.
- Executive exposure: see breach exposure for CxO, VP, and director accounts separately.
- Trends and analytics: yearly trend of exposed emails, top breaches affecting your domain, and per-breach detail including exposed data types.
- Phishing analysis: spot suspicious lookalike domains targeting your organization.
- Stealer-log exposure included free: browser-saved passwords, session cookies, and autofill data captured by infostealer malware on infected devices.
- API access: manage an API key from the dashboard and pull your domain's breach data into your own tooling, or use the official Sentinel, Splunk, and Wazuh integrations.
Who uses this
IT admins
Know when staff credentials are exposed, before attackers use them, and force resets while it matters.
MSPs
Verify multiple client domains and watch them all from one dashboard, at no cost per domain or per seat.
Security teams
Feed domain exposure into incident response and password-reset policy through the API and SIEM integrations.
Compliance and risk
Documented, continuous breach monitoring with quarterly summary reports, even for quarters where nothing happened.
Frequently asked questions
How is this different from Have I Been Pwned's domain search?
Have I Been Pwned's domain search requires a paid subscription, priced by the number of addresses on the domain. XposedOrNot's domain monitoring is free with no size limits: full monitoring, automatic alerts, and stealer-log coverage at no cost, for any organization size.
Really free? What's the catch?
There is no catch. XposedOrNot is an open-source project maintained by Devanand Premkumar and run in the open since 2017. The commercial xonPlus products are what keep the free tier free, and the community edition will always remain free. Searches are not logged, and your data is never sold or shared.
Can someone monitor a domain they don't own?
No. Ownership must be verified before monitoring activates: a verification link sent to a standard address on the domain, a DNS TXT record, or an HTML tag or file on the website.
What happens to my employee email data?
XposedOrNot stores only email addresses extracted from publicly circulating breaches, plus public breach metadata; passwords and other sensitive data are never stored. Per-address results for your domain are only visible after you verify ownership, searches are not logged in any identifiable form, and nothing is sold or shared. Details in the methodology and Transparency Report.
How fast are alerts after a new breach?
Alerts are automatic. When a newly indexed breach contains addresses on your verified domain, an alert email goes to your monitoring address and the breach appears in your dashboard's real-time alerts. You never need to check back manually.
Can I monitor multiple domains?
Yes. Verify each domain you control and manage them all from one dashboard, which shows monitored domains, exposed emails, and exposed records across your portfolio.
Is there an API?
Yes. After verification, the dashboard's API key management gives access to the domain-breaches API, and official connectors exist for Microsoft Sentinel, Splunk, and Wazuh. Need team access or alerts in Slack, Teams, or webhooks? xonEnterprise+ covers that.
Start now
Free, no limits, automatic alerts. Verified setup in minutes.