Email Breach Checker – Check If Your Email Was Hacked 🔓

🎉 Check any email against public breach records in one call

For IT admins, MSPs, security teams and anyone who has ever wondered "was my email hacked?"

---

🔎 What is the Email Breach Checker — and when should you use it?

The Email Breach Checker turns an email address, username or password you want checked against public breach records into clean, structured rows you can filter, export and feed straight into a spreadsheet, database or AI agent. No account, no portal API key, no browser automation to maintain.

Use it when you need: one graded row per term: breached true or false, the total record count, the breach sources involved, and where the source published password material a masked sighting with its SHA-1 and hash. Email terms match exactly. Bulk lists run one charge per term, and a clean credential returns an explicit breached=false row rather than silence.

Use something else when: you want to know whether an address can receive mail rather than whether it leaked. Use Email Verifier & Validator for deliverability: syntax, MX records, disposable and catch-all detection, and a mailbox-level verdict where the receiving server answers. Use Email & Contact Lead Scraper for collecting addresses from websites in the first place, which this actor can then check for breach exposure. This actor answers from indexed public breach corpora, so a clean result means no indexed record matched, not proof a credential was never breached. Non-email terms run a match search capped at 1,000 records; use the full email address for an exact identity check.

🤖 Use with AI agents

Already connected to the Apify MCP server? Just ask for this Actor by name: sian.agency/email-breach-checker

Your agent can pay for its own runs. This Actor is eligible for agentic payments, so an agent can discover it, run it and settle the bill over x402 (USDC on Base) or Skyfire — without an Apify account or API token of its own. Billing is the same either way: per successful row, never for errors.

Otherwise copy this prompt into Claude, ChatGPT, Cursor or any MCP-enabled assistant:

I want to know whether a credential appears in known data breaches and what to rotate first using the Apify Actor `sian.agency/email-breach-checker`.

Use it when I need: one graded row per term: breached true or false, the total record count, the breach sources involved, and where the source published password material a masked sighting with its SHA-1 and hash. Email terms match exactly. Bulk lists run one charge per term, and a clean credential returns an explicit breached=false row rather than silence.

Don't use it when: you want to know whether an address can receive mail rather than whether it leaked — use email-verifier or email-contact-lead-scraper instead.

How to call it: pick one operation per run. `lookup` checks an email or username against breach records; `passwordCheck` reports how many times a password appears in the corpora. Pass a single term in `term`, a list in `terms`, or a hosted text or CSV file URL in `requestsFromUrl`. `maxRecords` caps the embedded record detail per row (the full count is always reported).

Start with this input:
{
  "operation": "lookup",
  "term": "admin@admin.com",
  "maxRecords": "20"
}

Ask me which email address, username or password to check, and whether it is a single check or a bulk list, then run the Actor and summarise the results as a table.

Things you can ask your agent for:

• Check my personal email and tell me which services leaked it and whether I should rotate passwords
• Screen this list of 200 sign-up addresses against breach records and flag the hits
• Check whether this password appears in breach corpora before I reuse it on a new account

Machine-readable API, MCP config and OpenAPI definition for this Actor are published at apify.com/sian.agency/email-breach-checker.md.

📋 Overview

Email Breach Checker answers one question fast: has this credential appeared in a known data breach? Built for IT admins sweeping client domains, developers screening sign-ups, and anyone doing a personal exposure audit.

Why professionals choose us:

• ✅ Flat per-check pricing: one charge per term, however many records it matches. A common address that hits 35,000 records costs the same as a clean one
• ⚡ One call per check: answers in seconds, thousands of terms per run in bulk
• 🎯 Full record detail: breach source, masked password sighting, SHA-1 and hash embedded in every row
• 💰 Free tier that proves it: 5 checks per run before you pay anything
• 📊 One honest row per term: a clean credential returns an explicit breached=false row, never silence
• ✨ NEW: bulk list files. Point the actor at a hosted .txt or .csv and audit the whole list in one scheduled run

✨ Features

• 🔎 Breach Lookup: check an email or username against indexed public breach records
• 🔑 Password Exposure Check: see how many times a password appears across breach corpora
• 🚨 Instant verdict: breached true/false plus the total record count on every row
• 🗂️ Breach sources: the services that leaked each credential, deduplicated per term
• 🔐 Password sightings: masked password material with SHA-1 and hash where the source published it
• 📚 Bulk lists: paste terms, load them from a URL, or schedule recurring sweeps
• 📥 Clean data: one structured row per term, ready for JSON, CSV or Excel export
• 🤖 Agent-ready: MCP, x402 agentic payments and a copy-paste prompt for AI workflows

🎬 Quick Start

Paste an email address and run. The default input is a working example, so pressing Start returns a graded verdict row.

curl -X POST https://api.apify.com/v2/acts/sian.agency~email-breach-checker/runs?token=[YOUR_TOKEN] \
-d '{"operation": "lookup", "term": "admin@admin.com"}'

🚀 Getting Started (3 Simple Steps)

Step 1: Pick what you want to check

Choose Breach Lookup for an email or username, or Password Exposure Check for a password.

Step 2: Enter your term

Type one term, paste a bulk list, or point the actor at a hosted file with one term per line.

Step 3: Run and read the verdict

Each term returns one row: breached true/false, record count, breach sources and embedded record detail.

That's it! In under a minute, you'll have:

• A per-term verdict you can filter and export
• Breach sources for every hit
• Password-exposure flags for rotation priorities

📥 Input Configuration

Field	Type	Required	Description
operation	select	No	lookup (email/username breach check) or passwordCheck (leaked-password count)
term	string	No	Single term: email, username or password
terms	array	No	Bulk list of terms, one per line
requestsFromUrl	string	No	Public URL of a .txt/.csv file with one term per line
maxRecords	select	No	Embedded record detail per term (10–200, default 20)

Example:

{
  "operation": "lookup",
  "term": "admin@admin.com",
  "maxRecords": "20"
}

Bulk Processing:

{
  "operation": "lookup",
  "terms": ["admin@admin.com", "test@example.org", "janedoe"],
  "maxRecords": "50"
}

📤 Output

Results are saved to the Apify dataset with one row per checked term:

Field	Type	Description
term	string	The term that was checked
termType	string	email, username or password
breached	boolean	True when at least one record matched
recordCount	integer	Total matching breach records
passwordExposed	boolean	True when password material exists in the records
sources	array	Distinct breach sources (up to 50)
records	array	Embedded detail: matched credential, source, password sighting, SHA-1, hash
checkedAt	string	When the check ran

Example:

{
  "term": "admin@admin.com",
  "termType": "email",
  "breached": true,
  "recordCount": 35992,
  "passwordExposed": true,
  "sources": ["Collection 1", "MySpace.com", "Evony.com"],
  "records": [
    {
      "matchedCredential": "admin@admin.com",
      "source": "Collection 1",
      "password": "hello****",
      "sha1": "6d372fc00cf40aaa14cc4dc144303e7cd367848b",
      "hash": "7x0ncxseESto+ilLCC5FIvGRLIBvLyf+"
    }
  ],
  "status": "success"
}

💼 Use Cases & Examples

1. Personal exposure audit

Anyone who wants to know if their email was pwned.

Input: your email address, operation lookup Output: every breach source, plus which records carry password material Use: decide what to rotate first and turn on better 2FA where it leaked

2. Sign-up screening under NIST 800-63B

Developers and SaaS teams checking new registrations against known breach data.

Input: bulk list of new-user addresses, operation lookup Output: a breached flag per address to feed your risk logic Use: block or challenge sign-ups whose credentials appear in known leaks

3. Password hygiene check

Security-conscious users before reusing a password anywhere.

Input: the password, operation passwordCheck Output: how many times it appears in breach corpora Use: any hit means rotate it everywhere it was used

4. MSP client credential sweeps

Managed service providers running recurring exposure reports for clients.

Input: scheduled run over a hosted list of client addresses via requestsFromUrl Output: one graded row per address, ready to forward as a report Use: monthly exposure reviews without manual work

5. Username exposure research

Brand-protection and OSINT teams checking public handles.

Input: a username, operation lookup Output: credentials whose records match the handle, capped at 1,000 by the source Use: spot impersonation and credential exposure around a public identity

6. Security research pipelines

Researchers pulling structured breach records into analysis workflows.

Input: bulk terms with a higher maxRecords Output: structured records (source, password sighting, SHA-1, hash) in the dataset Use: feed breach-analytics notebooks and threat-intel tooling

🔗 Integration Examples

JavaScript/Node.js

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: 'YOUR_TOKEN' });

const run = await client.actor('sian.agency/email-breach-checker').call({
  operation: 'lookup',
  term: 'admin@admin.com',
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0]);

Python

from apify_client import ApifyClient
client = ApifyClient('YOUR_TOKEN')

run = client.actor('sian.agency/email-breach-checker').call(
    run_input={'operation': 'lookup', 'term': 'admin@admin.com'}
)

for item in client.dataset(run['defaultDatasetId']).iterate_items():
    print(item)

cURL

curl -X POST 'https://api.apify.com/v2/acts/sian.agency~email-breach-checker/runs?token=YOUR_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"operation": "lookup", "term": "admin@admin.com"}'

Automation Workflows (N8N / Zapier / Make)

1. Trigger: Schedule or webhook
2. HTTP Request: Call actor API
3. Process: Handle JSON results
4. Action: Save, notify, or transform

📈 Performance & Pricing

FREE Tier (Try It Now)

• 5 checks per run with full feature access, same quality
• No credit card required
• Perfect for testing and small projects

PAID Tier (Production Ready)

• Unlimited checks per run
• Bulk lists and scheduled sweeps without caps
• Pay-per-check: only charged for successful results

💰 Flat per-check pricing: a term matching 35,000 records costs the same as a clean one, so your bill never depends on how badly a credential was breached.

🔗 View current pricing

❓ Frequently Asked Questions

Q: How many terms can I check in one run? A: FREE tier: 5 per run. PAID tier: unlimited — bulk lists of thousands run fine.

Q: Is checking a credential against breach data legal? A: Breach lookup is a standard defensive-security category. The records come from publicly indexed breach corpora, and the check answers whether a credential appears there. Use it on credentials you are authorized to assess.

Q: Do you store the terms I check? A: No. Terms exist only for the duration of the run and in the run's own dataset, which only you can read.

Q: What does a clean result mean? A: The credential matched no record in the indexed breach corpora. It is not a guarantee the credential was never breached — no lookup service can promise that.

Q: Why does a record sometimes show a password? A: Some breach corpora contain password material that was already public. Records carry what the source published, partially masked at the source. Treat any hit as rotate-immediately.

Q: A username check returned credentials I didn't type — why? A: Non-email terms run a match search: the source returns credentials whose records contain that term, capped at 1,000. For an exact identity check, use the full email address.

Q: What output formats are available? A: JSON, CSV and Excel — export directly from the Apify dataset, or pull rows via the API.

🐛 Troubleshooting

A run returned 0 rows

• Check that term or terms is non-empty, or that requestsFromUrl points at a publicly reachable file
• On the FREE tier a run stops after 5 checks — the remaining terms are simply not processed

One term failed but others succeeded

• That row carries an error message; re-run just that term. A temporary source hiccup retries automatically, and a failed check is never charged

A username check looks like it matched other people's credentials

• That is the documented match-search behavior for non-email terms. Use the full email address for an exact check

I need record detail beyond 200 per term

• maxRecords caps at 200, but recordCount always reports the true total. Increase the cap for exports, or paginate by re-running with a different subset

⚖️ Is it legal to check credentials against breach data?

Our actors do not extract private user data. This actor answers whether a credential appears in breach corpora that are already publicly indexed — the same defensive-security category as the mainstream breach-checker services. The intended use is assessing credentials you are authorized to assess: your own, your organization's, or your clients'.

You should be aware that results can contain personal data. Personal data is protected by the GDPR in the European Union and by other regulations around the world. Do not process personal data without a legitimate reason. If you're unsure whether your reason is legitimate, consult your lawyers.

You can also read Apify's blog post on the legality of web scraping.

🤝 Support

Join our active support community

• For issues or questions, open an issue in the actor's repository
• Check SIÁN Agency Store for more automation tools
• 📧 apify@sian-agency.online

---

Built by SIÁN Agency | More Tools