# XposedOrNot

> XposedOrNot is a free, open-source data breach monitoring platform that helps individuals and organizations check if their emails, passwords, or domains have been exposed in known data breaches. It provides real-time breach insights across billions of exposed records and 835+ million compromised passwords.

XposedOrNot offers a comprehensive suite of cybersecurity tools designed to protect digital identities. The platform is community-driven, fully transparent, and accessible to everyone, from individual users checking personal security to enterprises monitoring domain-level exposure.

Last updated: July 31, 2026. See [llms-full.txt](https://xposedornot.com/llms-full.txt) for the expanded reference with key statistics, the full FAQ, and the complete breach index.

## Core Features

- **Email Breach Check**: Search billions of exposed records to find if an email appears in any known data breach
- **Password Security**: Verify passwords against 835+ million exposed passwords using SHA-3 (Keccak-512) hashing
- **Domain Monitoring**: Track and verify domain ownership, monitor corporate email exposure
- **Stealer-Log Exposure**: Free checks against infostealer malware data (browser-saved passwords, session cookies, autofill data, crypto wallets), included in email search and domain scans at no cost
- **Privacy Shield**: Opt out of public searches to protect email addresses
- **Breach Repository**: Browse comprehensive database of all indexed data breaches

## Tools

- [Email Breach Search](https://xposedornot.com/): Check if your email has been exposed in data breaches
- [Password Check](https://xposedornot.com/password): Verify if a password has been compromised
- [Xposed Breaches](https://xposedornot.com/xposed): View detailed breach exposure for an email
- [Privacy Shield](https://xposedornot.com/shield): Protect your email from public searches
- [Domain Verification](https://xposedornot.com/domain): Verify domain ownership for monitoring
- [Domain Search](https://xposedornot.com/domains): Search breaches affecting a domain
- [Breach Visualisations](https://xposedornot.com/breaches-visualisations): Visualize data breaches over time
- [Breach Repository](https://xposedornot.com/xposed): Browse all indexed data breaches
- [Breach Statistics](https://xposedornot.com/our-repository): Live repository statistics: totals, yearly trends, industries, largest breaches
- [FAQ](https://xposedornot.com/faq): Frequently asked questions about XposedOrNot

## Notable Breaches

The 10 largest breaches indexed, by exposed records:

- [1.4BillionRecords](https://xposedornot.com/breach/1.4BillionRecords): 1,114,303,554 records (2017)
- [Collection-1](https://xposedornot.com/breach/Collection-1): 790,803,860 records (2019)
- [Verifications](https://xposedornot.com/breach/Verifications): 762,579,945 records (2019)
- [ExploitIN](https://xposedornot.com/breach/ExploitIN): 592,919,058 records (2016)
- [AntiPublicCombo](https://xposedornot.com/breach/AntiPublicCombo): 457,399,902 records (2016)
- [AlienStealerLogs](https://xposedornot.com/breach/AlienStealerLogs): 299,646,818 records (2025)
- [Alleged-SOCRadar](https://xposedornot.com/breach/Alleged-SOCRadar): 282,977,267 records (2024)
- [Wattpad](https://xposedornot.com/breach/Wattpad): 268,113,400 records (2020)
- [Deezer](https://xposedornot.com/breach/Deezer): 244,007,616 records (2019)
- [NetEase](https://xposedornot.com/breach/NetEase): 232,857,074 records (2015)

## API Documentation

XposedOrNot provides a RESTful API with JSON responses for developers to integrate breach checking into applications.

- [API Documentation](https://xposedornot.com/api_doc): Complete API reference with endpoints and examples

### Public API Endpoints (No Authentication Required)

- `GET https://api.xposedornot.com/v1/check-email/{email}` - Check if an email appears in any breach
- `GET https://api.xposedornot.com/v1/breach-analytics?email={email}` - Get detailed breach analytics for an email
- `GET https://passwords.xposedornot.com/api/v1/pass/anon/{first10_keccak512_hash}` - Check if a password is exposed (returns 200 if exposed, 404 if safe)
- `GET https://api.xposedornot.com/v1/breaches` - Retrieve list of all indexed data breaches

### Domain API Endpoints (API Key Required)

- `POST https://api.xposedornot.com/v1/domain-breaches/` - Check breaches affecting a verified domain (send the API key in the `x-api-key` header)
- API keys are available in the domain dashboard after verification

### Higher Rate Limits

The free API is rate-limited per IP. For production workloads, paid API plans start at $5/month (50 requests/min) and scale to 25,000 requests/min: see [xonAPI+](https://plus.xposedornot.com/products/api).

## Integrations

XposedOrNot breach intelligence plugs into common security tooling, all built on the XposedOrNot API.

- [Integrations Hub](https://xposedornot.com/integrations): Overview and status of all integrations
- [MISP](https://xposedornot.com/integrations/misp): Expansion and hover module for enriching email attributes with breach exposure
- [TheHive / Cortex](https://xposedornot.com/integrations/thehive-cortex): Cortex analyzer for email observables with breach taxonomies and reports
- [OpenCTI](https://xposedornot.com/integrations/opencti): Internal-enrichment connector for Email-Addr observables
- [Maltego](https://github.com/XposedOrNot/XposedOrNot-Maltego): Official Maltego transforms, live: investigate email breach exposure on the graph, no API key required
- [Wazuh](https://github.com/XposedOrNot/XposedOrNot-Wazuh): Official Wazuh integration, live: detect breached credentials in authentication and user-creation alerts, no API key required
- [Microsoft Sentinel](https://github.com/XposedOrNot/XposedOrNot-Sentinel): Official connector for domain exposure alerts and incident response
- [Splunk](https://splunkbase.splunk.com/app/7631): Official Splunk app, live: breached and exposed email insights for verified domains
- [Official SDKs](https://github.com/XposedOrNot): Client libraries for Python, JavaScript/TypeScript, Go, Ruby, PHP, Rust, .NET and Java
- MCP Server: Connect AI assistants via the Model Context Protocol at `api.xposedornot.com/mcp`. Six tools: `check_email_breaches`, `get_breach_analytics`, `list_breaches`, `domain_breach_summary`, `get_breach_metrics`, `get_recent_breaches`. Tool discovery: [server card](https://xposedornot.com/.well-known/mcp/server-card.json), [agent skills](https://xposedornot.com/.well-known/agent-skills/index.json)

## Commercial Edition (xonPlus)

xonPlus is the commercial edition of XposedOrNot, built on the same breach data and open-source detection engine. It serves businesses: developer APIs at higher rate limits, domain monitoring for security teams, and white-label multi-tenant breach intelligence for MSSPs and platforms. All pricing is public and self-serve.

- [xonAPI+](https://plus.xposedornot.com/products/api): Breach-check API for developers: real-time email and domain lookups, from $5/month
- [xonEnterprise+](https://plus.xposedornot.com/products/enterprise): Domain breach monitoring for security teams: alerts within 15 minutes, dashboards, CSV/PDF reports, from $25/month
- [xonThreatIntel+](https://plus.xposedornot.com/products/threat-intel): Breach intelligence feeds for MSSPs and platforms: white-label, multi-tenant, STIX/JSON/CSV with webhooks, from $99/month
- [Pricing](https://plus.xposedornot.com/pricing): Full public price list for all products
- [xonPlus llms.txt](https://plus.xposedornot.com/llms.txt): Complete commercial-edition reference

## Technical Details

- **Password Hashing**: Uses SHA-3 (Keccak-512) for secure client-side password checking
- **Privacy**: Passwords are never stored; only the first 10 characters of the hash are transmitted
- **Response Format**: JSON for all API endpoints
- **Authentication**: Most endpoints are public; domain endpoints require API key

## Resources

- [Blog](https://blog.xposedornot.com/): Security insights and breach news
- [GitHub](https://github.com/XposedOrNot): Open-source repository
- [llms-full.txt](https://xposedornot.com/llms-full.txt): Expanded reference: key statistics, full FAQ, complete breach index
- [Sitemap](https://xposedornot.com/sitemap.xml): All site pages
- [Breach Sitemap](https://xposedornot.com/sitemap-breaches.xml): All breach detail pages
- [Privacy Policy](https://xposedornot.com/privacy): Data handling practices
- [Terms of Service](https://xposedornot.com/terms): Usage terms
- [Status Page](https://stats.uptimerobot.com/3zjQkZ2Caa): Service uptime monitoring
- [Responsible Disclosure](https://xposedornot.com/responsible-disclosure): Security vulnerability reporting

## Optional

### Supported Languages for Password Check Implementation

Code examples are available for client-side password checking in:
- jQuery/JavaScript
- PHP
- Python
- Ruby
- Java
- Go
- Rust

### Trust and Security

- Open-source and community-driven
- WCAG AA accessible
- No password storage in plain text
- SHA-3 encryption for sensitive operations
- Transparent data practices
- Multi-language support (12+ languages)