What comes back
A verdict first, in a sentence: who the address appears to belong to and whether it has been exposed. Then the evidence.
- Linked accounts. Which services have an account on that address, with a link to the public profile where one exists. This is the part that tends to surprise people about their own address.
- Data breaches. Which known breaches contain it, the year, and what kind of data went out in each. A password in a 2019 dump is a different problem from an email in a marketing list.
- The name attached. Where a service exposes a display name or an avatar publicly, it is shown along with which service said so.
- Address health. Whether the domain can actually receive mail, and whether it belongs to a disposable-address provider. A signup from a throwaway domain is worth knowing about.
- A timeline. When accounts were created and when breaches happened, in order, which is usually the fastest way to see whether an identity was built recently.
Where it looks
Seventy-one sources in one pass. They fall into four groups.
Breach databases. Have I Been Pwned, BreachDirectory, LeakCheck, HackCheck and Hudson Rock, which between them cover most of the public breach corpus, including the infostealer logs that the older breach lists miss.
Account existence. Whether that address has an account at Adobe, Amazon, Apple, Atlassian, Discord, eBay, GitHub, GitLab, Instagram, LinkedIn, Spotify, Twitter and around forty more. Each is checked the way the service itself allows, through its own password-reset or signup path.
Public profile data. Gravatar, Keybase, Google account metadata and public GitHub commit history, all of which attach a name or a photo to an address when the owner has published one.
The address itself. Domain and mail records, disposable-provider lists, and reputation scoring.
What it will not tell you
- The password. Breach records say an address appeared in a dump and what kind of data it held. We do not store or show credentials.
- Private account contents. Whether an account exists is public. What is inside it is not.
- Anything about an account the owner has kept genuinely private. An address used once, nowhere else, comes back nearly empty.
Running it on your own address
This is the most common first use and the most useful one. The report tells you which of your accounts are discoverable from your address, which breaches have you, and therefore which passwords are worth changing first.
If a breach in the list is one where passwords went out, change that password everywhere you reused it, not just on that service. You can check whether a specific password is in a public dump with the password check, which never sends the password anywhere.
Common questions
Is the person notified that their address was looked up?
No. Account-existence checks use the paths those services expose publicly and do not trigger a login attempt, a password reset or an alert.
Why does it say an account exists when the profile is not public?
Because those are two different facts. A service can confirm an address is registered without exposing anything inside the account. The report says which of the two it found.
The report found breaches I have never heard of. Is that bad?
Usually it means a service you used years ago was breached and never told you clearly. What matters is the kind of data each one exposed, which the report lists per breach. Passwords and security answers matter; a mailing list rarely does.
Can I look up a work address?
Technically yes, and it behaves the same. Be aware that using a report to decide anything about somebody's employment falls under the FCRA, and this is not a consumer reporting agency. See the responsible use policy.