What it checks
- Email address — which known breaches included it, when they happened and what data was exposed
- Password — whether it appears in leaked password lists, checked so the full password never leaves your device
- Breach catalogue — browse and filter breaches by name, size or date
If you are in a breach
- Change the password on that site, and anywhere you reused it
- Turn on two-step verification
- Use a password manager so every account has a unique password
- Be careful with emails or calls that mention the breach, as scammers use them
Privacy and limits
- For password checks, the full password stays in the browser. The first five characters of its SHA-1 hash are sent for a range lookup; the browser checks the returned suffix list for a match.
- Email breach lookups transmit the entered address to the selected breach source(s), which can include Have I Been Pwned, LeakCheck and XposedOrNot. Do not use the lookup for an address you do not want processed by those services.
- A clean result covers only breaches that have been collected. It does not prove an account is safe.
Lost money to a scam?
- Call the national cybercrime helpline 1930 immediately
- File a complaint at cybercrime.gov.in