See whether an email shows up in known public breaches. Powered by Have I Been Pwned, proxied for privacy.
All calculations happen in your browser. We don’t store inputs.
An email address you control or want to audit.
We hash the address with SHA-1 in your browser. The lookup runs through our proxy to Have I Been Pwned. The proxy does not log inputs.
A list of public breaches the address appears in, with breach name, date, and the categories of data exposed.
Run this on your work email, your personal email, and any address you use for sensitive accounts.
For each match, you see the breach name, date, and the data classes exposed (passwords, addresses, phone numbers, IPs).
A list of credentials to rotate and a clear sense of which accounts to lock down with multi-factor.
You can also run this on a senior team member or family member with their consent.
Have I Been Pwned only indexes publicly disclosed breaches. The full universe of credential exposure is larger.
A starting list of cleanups, not a complete picture.
This is a starting check, not a complete audit. Have I Been Pwned indexes public breaches; private breaches, undisclosed compromises, and credential-stuffing lists circulating in the wild are not always represented. A clean result here does not mean an address is safe; it means it is not in the public index. The reverse is also true: an address that shows in a 2018 breach is not actively being attacked right now, just exposed historically. The right follow-up to a hit is to rotate the password (especially if it was re-used elsewhere), turn on multi-factor authentication on the affected service, and check whether the address still belongs to you. We do not store the address you entered. We do not log it. The proxy that forwards the request to Have I Been Pwned is configured not to log inputs.
Once you know an address has been exposed, watch for spear-phishing arriving in its name.
Generate the variants attackers register after a high-profile address gets exposed.
How attackers turn an exposed email into a foothold via password-reset flows.
A practical playbook for compartmentalizing email so a breach does not cascade.
Multi-factor on a breached account is necessary but not sufficient. Here is what else matters.
Rythm is the inbox protection that powers this estimate. $1.65 per month. Cancel anytime.
Annual on Lightning includes one bonus month. See full pricing.
