Enter a domain to see how many of its email addresses appear in the 782 breaches we index, across how many breaches, and when it was last seen. The check is free for any organisation, with no size limit. Verify the domain by DNS, HTML file or email to see which breaches, and to unlock alerts for every address.
- 782 breaches indexed
- 11.6 billion+ records
- Free, no size limit
- Updated September 2026
How it works
Verify your domain
Email link, DNS TXT record, or an HTML file on your site. Only domains you control.
We watch, continuously
Every new breach is checked against your domain, stealer logs included. See the methodology.
You get alerted automatically
An email when your domain appears in a new breach, and a quarterly summary even when nothing happened.
Whether you have 10 employees or 50,000, it's free
Most services price domain monitoring per address. XposedOrNot doesn't: every verified domain gets full monitoring and alerts at no cost.
What you get after verification
- Automatic breach alerts by email, with severity and affected count
- Exposure overview and trends: exposed emails by year, top breaches, data types
- Executive exposure for CxO, VP, and director accounts
- Phishing analysis of lookalike domains targeting you
- Stealer-log exposure: browser passwords, cookies, autofill
- API access plus Sentinel, Splunk, and Wazuh connectors
Who uses this
IT admins
Know when staff credentials leak and force resets while it still matters.
MSPs
Verify every client domain and watch them from one dashboard, with no per-seat cost.
Security teams
Feed domain exposure into incident response through the API and SIEM connectors.
Compliance and risk
Continuous, documented monitoring with quarterly reports, even for quiet quarters.
Frequently asked questions
How do I check a domain for data breaches for free?
Type the domain into the box at the top of this page and press Check my domain. You get the breach count, the number of exposed addresses, and the last-seen date, with no signup. Verifying the domain unlocks the address list and the breach names.
Is my company domain in a data breach?
Run the free check above. A zero result means none of the domain's addresses appear in the 782 breaches we index today. Verify the domain to be alerted the moment that changes.
What does domain exposure mean?
The email addresses on a domain that appear in known breaches, plus whatever leaked alongside them. One exposed address is a phishing target; many with passwords are a credential-stuffing risk for the whole organisation.
How is this different from checking one email?
An email check covers one person. A domain check covers every address on the domain at once, including staff who never checked, and after verification it keeps watching every new breach automatically.
How is this different from Have I Been Pwned's domain search?
Have I Been Pwned charges for domain search by address count. XposedOrNot's domain check and monitoring are free with no size limit, stealer logs included.
Really free? What's the catch?
No catch. XposedOrNot is open source and has run in the open since 2017. The commercial xonPlus products keep the free tier free. Searches are never logged, sold, or shared.
Can someone monitor a domain they don't own?
No. Monitoring only activates after ownership is verified by email link, DNS TXT record, or an HTML tag or file on the site.
What happens to my employee email data?
We store only addresses found in publicly circulating breaches, plus public breach metadata, never passwords. Per-address results appear only after verification, and nothing is sold or shared. Details in the methodology and Transparency Report.
How fast are alerts after a new breach?
Automatic. When a newly indexed breach contains addresses on your verified domain, an email goes to your monitoring address and the breach appears in your dashboard's real-time alerts.
Can I monitor multiple domains?
Yes. Verify each domain you control and manage them all from one dashboard.
Is there an API?
Yes. After verification the dashboard issues an API key for the domain-breaches endpoint, and official connectors exist for Microsoft Sentinel, Splunk, and Wazuh. Team access and Slack, Teams, or webhook alerts are in xonEnterprise+.
Start now
Free, no limits, automatic alerts. Verified setup in minutes.