# Email Breach Checker – Check If Your Email Was Hacked (`sian.agency/email-breach-checker`) Actor

Check any email or username against indexed public breach records: breach sources, exposed password sightings and hashes per credential. Bulk lists. Pay per check.

- **URL**: https://apify.com/sian.agency/email-breach-checker.md
- **Developed by:** [SIÁN OÜ](https://apify.com/sian.agency) (community)
- **Categories:** Developer tools, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $22.50 / 1,000 breach lookups

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Email Breach Checker – Check If Your Email Was Hacked 🔓

[![Store-SI%C3%81N%20Agency-1AE392](https://img.shields.io/badge/Store-SI%C3%81N%20Agency-1AE392)](https://apify.com/sian.agency?fpr=sian) [![Store-Email%20Verifier-1AE392](https://img.shields.io/badge/Store-Email%20Verifier-1AE392)](https://apify.com/sian.agency/email-verifier?fpr=sian) [![Store-Email%20Lead%20Scraper-1AE392](https://img.shields.io/badge/Store-Email%20Lead%20Scraper-1AE392)](https://apify.com/sian.agency/email-contact-lead-scraper?fpr=sian) [![Store-HIBP%20Breaches%20Catalog-1AE392](https://img.shields.io/badge/Store-HIBP%20Breaches%20Catalog-1AE392)](https://apify.com/parseforge/hibp-breaches-catalog-scraper?fpr=sian)

#### 🎉 Check any email against public breach records in one call

##### For IT admins, MSPs, security teams and anyone who has ever wondered "was my email hacked?"

***

### 🔎 What is the Email Breach Checker — and when should you use it?

The **Email Breach Checker** turns an email address, username or password you want checked against public breach records into clean, structured rows you can filter, export and feed straight into a spreadsheet, database or AI agent. No account, no portal API key, no browser automation to maintain.

**Use it when you need:** one graded row per term: breached true or false, the total record count, the breach sources involved, and where the source published password material a masked sighting with its SHA-1 and hash. Email terms match exactly. Bulk lists run one charge per term, and a clean credential returns an explicit breached=false row rather than silence.

**Use something else when:** you want to know whether an address can receive mail rather than whether it leaked. Use [Email Verifier & Validator](https://apify.com/sian.agency/email-verifier?fpr=sian) for deliverability: syntax, MX records, disposable and catch-all detection, and a mailbox-level verdict where the receiving server answers. Use [Email & Contact Lead Scraper](https://apify.com/sian.agency/email-contact-lead-scraper?fpr=sian) for collecting addresses from websites in the first place, which this actor can then check for breach exposure. This actor answers from indexed public breach corpora, so a clean result means no indexed record matched, not proof a credential was never breached. Non-email terms run a match search capped at 1,000 records; use the full email address for an exact identity check.

### 🤖 Use with AI agents

Already connected to the [Apify MCP server](https://mcp.apify.com)? Just ask for this Actor by name: sian.agency/email-breach-checker

**Your agent can pay for its own runs.** This Actor is eligible for [agentic payments](https://docs.apify.com/platform/actors/publishing/monetize), so an agent can discover it, run it and settle the bill over [x402](https://www.x402.org/) (USDC on Base) or [Skyfire](https://www.skyfire.xyz/) — without an Apify account or API token of its own. Billing is the same either way: per successful row, never for errors.

Otherwise copy this prompt into Claude, ChatGPT, Cursor or any MCP-enabled assistant:

```text
I want to know whether a credential appears in known data breaches and what to rotate first using the Apify Actor `sian.agency/email-breach-checker`.

Use it when I need: one graded row per term: breached true or false, the total record count, the breach sources involved, and where the source published password material a masked sighting with its SHA-1 and hash. Email terms match exactly. Bulk lists run one charge per term, and a clean credential returns an explicit breached=false row rather than silence.

Don't use it when: you want to know whether an address can receive mail rather than whether it leaked — use email-verifier or email-contact-lead-scraper instead.

How to call it: pick one operation per run. `lookup` checks an email or username against breach records; `passwordCheck` reports how many times a password appears in the corpora. Pass a single term in `term`, a list in `terms`, or a hosted text or CSV file URL in `requestsFromUrl`. `maxRecords` caps the embedded record detail per row (the full count is always reported).

Start with this input:
{
  "operation": "lookup",
  "term": "admin@admin.com",
  "maxRecords": "20"
}

Ask me which email address, username or password to check, and whether it is a single check or a bulk list, then run the Actor and summarise the results as a table.
```

**Things you can ask your agent for:**

- *Check my personal email and tell me which services leaked it and whether I should rotate passwords*
- *Screen this list of 200 sign-up addresses against breach records and flag the hits*
- *Check whether this password appears in breach corpora before I reuse it on a new account*

Machine-readable API, MCP config and OpenAPI definition for this Actor are published at [apify.com/sian.agency/email-breach-checker.md](https://apify.com/sian.agency/email-breach-checker.md).

### 📋 Overview

**Email Breach Checker** answers one question fast: has this credential appeared in a known data breach? Built for IT admins sweeping client domains, developers screening sign-ups, and anyone doing a personal exposure audit.

**Why professionals choose us:**

- ✅ **Flat per-check pricing**: one charge per term, however many records it matches. A common address that hits 35,000 records costs the same as a clean one
- ⚡ **One call per check**: answers in seconds, thousands of terms per run in bulk
- 🎯 **Full record detail**: breach source, masked password sighting, SHA-1 and hash embedded in every row
- 💰 **Free tier that proves it**: 5 checks per run before you pay anything
- 📊 **One honest row per term**: a clean credential returns an explicit breached=false row, never silence
- ✨ **NEW**: bulk list files. Point the actor at a hosted .txt or .csv and audit the whole list in one scheduled run

### ✨ Features

- 🔎 **Breach Lookup**: check an email or username against indexed public breach records
- 🔑 **Password Exposure Check**: see how many times a password appears across breach corpora
- 🚨 **Instant verdict**: breached true/false plus the total record count on every row
- 🗂️ **Breach sources**: the services that leaked each credential, deduplicated per term
- 🔐 **Password sightings**: masked password material with SHA-1 and hash where the source published it
- 📚 **Bulk lists**: paste terms, load them from a URL, or schedule recurring sweeps
- 📥 **Clean data**: one structured row per term, ready for JSON, CSV or Excel export
- 🤖 **Agent-ready**: MCP, x402 agentic payments and a copy-paste prompt for AI workflows

### 🎬 Quick Start

Paste an email address and run. The default input is a working example, so pressing Start returns a graded verdict row.

```bash
curl -X POST https://api.apify.com/v2/acts/sian.agency~email-breach-checker/runs?token=[YOUR_TOKEN] \
-d '{"operation": "lookup", "term": "admin@admin.com"}'
```

### 🚀 Getting Started (3 Simple Steps)

#### Step 1: Pick what you want to check

Choose **Breach Lookup** for an email or username, or **Password Exposure Check** for a password.

#### Step 2: Enter your term

Type one term, paste a bulk list, or point the actor at a hosted file with one term per line.

#### Step 3: Run and read the verdict

Each term returns one row: breached true/false, record count, breach sources and embedded record detail.

**That's it! In under a minute, you'll have:**

- A per-term verdict you can filter and export
- Breach sources for every hit
- Password-exposure flags for rotation priorities

### 📥 Input Configuration

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `operation` | select | No | `lookup` (email/username breach check) or `passwordCheck` (leaked-password count) |
| `term` | string | No | Single term: email, username or password |
| `terms` | array | No | Bulk list of terms, one per line |
| `requestsFromUrl` | string | No | Public URL of a .txt/.csv file with one term per line |
| `maxRecords` | select | No | Embedded record detail per term (10–200, default 20) |

**Example:**

```json
{
  "operation": "lookup",
  "term": "admin@admin.com",
  "maxRecords": "20"
}
```

**Bulk Processing:**

```json
{
  "operation": "lookup",
  "terms": ["admin@admin.com", "test@example.org", "janedoe"],
  "maxRecords": "50"
}
```

### 📤 Output

Results are saved to the Apify dataset with one row per checked term:

| Field | Type | Description |
|-------|------|-------------|
| `term` | string | The term that was checked |
| `termType` | string | email, username or password |
| `breached` | boolean | True when at least one record matched |
| `recordCount` | integer | Total matching breach records |
| `passwordExposed` | boolean | True when password material exists in the records |
| `sources` | array | Distinct breach sources (up to 50) |
| `records` | array | Embedded detail: matched credential, source, password sighting, SHA-1, hash |
| `checkedAt` | string | When the check ran |

**Example:**

```json
{
  "term": "admin@admin.com",
  "termType": "email",
  "breached": true,
  "recordCount": 35992,
  "passwordExposed": true,
  "sources": ["Collection 1", "MySpace.com", "Evony.com"],
  "records": [
    {
      "matchedCredential": "admin@admin.com",
      "source": "Collection 1",
      "password": "hello****",
      "sha1": "6d372fc00cf40aaa14cc4dc144303e7cd367848b",
      "hash": "7x0ncxseESto+ilLCC5FIvGRLIBvLyf+"
    }
  ],
  "status": "success"
}
```

### 💼 Use Cases & Examples

#### 1. Personal exposure audit

**Anyone who wants to know if their email was pwned.**

**Input:** your email address, operation `lookup`
**Output:** every breach source, plus which records carry password material
**Use:** decide what to rotate first and turn on better 2FA where it leaked

#### 2. Sign-up screening under NIST 800-63B

**Developers and SaaS teams checking new registrations against known breach data.**

**Input:** bulk list of new-user addresses, operation `lookup`
**Output:** a breached flag per address to feed your risk logic
**Use:** block or challenge sign-ups whose credentials appear in known leaks

#### 3. Password hygiene check

**Security-conscious users before reusing a password anywhere.**

**Input:** the password, operation `passwordCheck`
**Output:** how many times it appears in breach corpora
**Use:** any hit means rotate it everywhere it was used

#### 4. MSP client credential sweeps

**Managed service providers running recurring exposure reports for clients.**

**Input:** scheduled run over a hosted list of client addresses via `requestsFromUrl`
**Output:** one graded row per address, ready to forward as a report
**Use:** monthly exposure reviews without manual work

#### 5. Username exposure research

**Brand-protection and OSINT teams checking public handles.**

**Input:** a username, operation `lookup`
**Output:** credentials whose records match the handle, capped at 1,000 by the source
**Use:** spot impersonation and credential exposure around a public identity

#### 6. Security research pipelines

**Researchers pulling structured breach records into analysis workflows.**

**Input:** bulk terms with a higher `maxRecords`
**Output:** structured records (source, password sighting, SHA-1, hash) in the dataset
**Use:** feed breach-analytics notebooks and threat-intel tooling

### 🔗 Integration Examples

#### JavaScript/Node.js

```javascript
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: 'YOUR_TOKEN' });

const run = await client.actor('sian.agency/email-breach-checker').call({
  operation: 'lookup',
  term: 'admin@admin.com',
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0]);
```

#### Python

```python
from apify_client import ApifyClient
client = ApifyClient('YOUR_TOKEN')

run = client.actor('sian.agency/email-breach-checker').call(
    run_input={'operation': 'lookup', 'term': 'admin@admin.com'}
)

for item in client.dataset(run['defaultDatasetId']).iterate_items():
    print(item)
```

#### cURL

```bash
curl -X POST 'https://api.apify.com/v2/acts/sian.agency~email-breach-checker/runs?token=YOUR_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"operation": "lookup", "term": "admin@admin.com"}'
```

#### Automation Workflows (N8N / Zapier / Make)

1. **Trigger**: Schedule or webhook
2. **HTTP Request**: Call actor API
3. **Process**: Handle JSON results
4. **Action**: Save, notify, or transform

### 📈 Performance & Pricing

#### FREE Tier (Try It Now)

- **5 checks** per run with full feature access, same quality
- No credit card required
- Perfect for testing and small projects

#### PAID Tier (Production Ready)

- **Unlimited** checks per run
- Bulk lists and scheduled sweeps without caps
- Pay-per-check: only charged for successful results

💰 **Flat per-check pricing**: a term matching 35,000 records costs the same as a clean one, so your bill never depends on how badly a credential was breached.

🔗 [View current pricing](https://apify.com/sian.agency/email-breach-checker?fpr=sian)

### ❓ Frequently Asked Questions

**Q: How many terms can I check in one run?**
A: FREE tier: 5 per run. PAID tier: unlimited — bulk lists of thousands run fine.

**Q: Is checking a credential against breach data legal?**
A: Breach lookup is a standard defensive-security category. The records come from publicly indexed breach corpora, and the check answers whether a credential appears there. Use it on credentials you are authorized to assess.

**Q: Do you store the terms I check?**
A: No. Terms exist only for the duration of the run and in the run's own dataset, which only you can read.

**Q: What does a clean result mean?**
A: The credential matched no record in the indexed breach corpora. It is not a guarantee the credential was never breached — no lookup service can promise that.

**Q: Why does a record sometimes show a password?**
A: Some breach corpora contain password material that was already public. Records carry what the source published, partially masked at the source. Treat any hit as rotate-immediately.

**Q: A username check returned credentials I didn't type — why?**
A: Non-email terms run a match search: the source returns credentials whose records contain that term, capped at 1,000. For an exact identity check, use the full email address.

**Q: What output formats are available?**
A: JSON, CSV and Excel — export directly from the Apify dataset, or pull rows via the API.

### 🐛 Troubleshooting

**A run returned 0 rows**

- Check that `term` or `terms` is non-empty, or that `requestsFromUrl` points at a publicly reachable file
- On the FREE tier a run stops after 5 checks — the remaining terms are simply not processed

**One term failed but others succeeded**

- That row carries an error message; re-run just that term. A temporary source hiccup retries automatically, and a failed check is never charged

**A username check looks like it matched other people's credentials**

- That is the documented match-search behavior for non-email terms. Use the full email address for an exact check

**I need record detail beyond 200 per term**

- `maxRecords` caps at 200, but `recordCount` always reports the true total. Increase the cap for exports, or paginate by re-running with a different subset

### ⚖️ Is it legal to check credentials against breach data?

Our actors do not extract private user data. This actor answers whether a credential appears in breach corpora that are already publicly indexed — the same defensive-security category as the mainstream breach-checker services. The intended use is assessing credentials you are authorized to assess: your own, your organization's, or your clients'.

You should be aware that results can contain personal data. Personal data is protected by the **GDPR** in the European Union and by other regulations around the world. Do not process personal data without a legitimate reason. If you're unsure whether your reason is legitimate, consult your lawyers.

You can also read Apify's blog post on the [legality of web scraping](https://blog.apify.com/is-web-scraping-legal/).

### 🤝 Support

[![Telegram Support](https://img.shields.io/badge/Telegram-Support%20Group-0088cc?logo=telegram)](https://t.me/+vyh1sRE08sAxMGRi)

**Join our active support community**

- For issues or questions, open an issue in the actor's repository
- Check [SIÁN Agency Store](https://apify.com/sian.agency?fpr=sian) for more automation tools
- 📧 <apify@sian-agency.online>

***

**Built by [SIÁN Agency](https://www.sian-agency.online)** | **[More Tools](https://apify.com/sian.agency?fpr=sian)**

# Actor input Schema

## `operation` (type: `string`):

One check per term: the record count, the breach sources involved, and the exposed password sightings or hashes for that credential; a password check reports how many times a password appears in the corpora.

## `term` (type: `string`):

🔎 **SINGLE CHECK:** An email address (e.g. name@company.com) or a username for Breach Lookup, or a password for the Password Exposure Check.

🎯 **TIP:** Leave this empty when you use the bulk list below — both work in the same run, the single term is checked first.

## `terms` (type: `array`):

📚 **BULK PROCESSING:** Check many terms at once — one per line. Emails and usernames for Breach Lookup, passwords for the Password Exposure Check.

🎯 **TIER-BASED LIMITS:**

- **FREE users:** Up to 5 checks per run
- **PAID users:** Unlimited checks

💡 **TIP:** Use "Bulk edit" to paste a list, or point 📥 Load terms from URL at a hosted .txt or .csv file (one term per line). Duplicates are removed before anything is charged.

## `requestsFromUrl` (type: `string`):

📥 **LIST FILE:** Public URL of a text or CSV file with one term per line. Handy for very large lists and scheduled runs over a file you keep updated.

## `maxRecords` (type: `string`):

📑 **RECORD DETAIL:** How many breach records to embed in each result row. The full record count is always reported — a term matching 5,000 records still says 5,000, this only caps the embedded detail rows.

## Actor input object example

```json
{
  "operation": "lookup",
  "term": "admin@admin.com",
  "requestsFromUrl": "https://example.com/terms.txt",
  "maxRecords": "20"
}
```

# Actor output Schema

## `breachChecks` (type: `string`):

Every breach or password check this run returned, one row per term.

## `scrapingSummary` (type: `string`):

HTML summary showing successful and failed results with key metrics

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "operation": "lookup",
    "term": "admin@admin.com",
    "maxRecords": "20"
};

// Run the Actor and wait for it to finish
const run = await client.actor("sian.agency/email-breach-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "operation": "lookup",
    "term": "admin@admin.com",
    "maxRecords": "20",
}

# Run the Actor and wait for it to finish
run = client.actor("sian.agency/email-breach-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "operation": "lookup",
  "term": "admin@admin.com",
  "maxRecords": "20"
}' |
apify call sian.agency/email-breach-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,sian.agency/email-breach-checker"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/31Wrz21MhVkCJNhkP/builds/m18k7Bjhmds3t6arU/openapi.json