Find what’s exposed
before attackers do.

LeakHash is a breach intelligence and exposure-monitoring platform. It continuously collects publicly circulating breach dumps, combolists and infostealer logs, structures them with the LeakHash Algorithms, and makes every record searchable and alertable.

It is built for:

• Security and IT teams protecting their own domains and accounts.
• MSPs and consultants watching many client domains at once.
• Incident responders who need the exact record, not a yes/no answer.
• Fraud and OSINT investigators tracing identities and infrastructure.
• Individuals who want to know what a breach actually exposed about them.

Yes, when used as intended: to assess accounts, domains and systems you own or are explicitly authorised to investigate. That is the same purpose security teams, pentesters and researchers use breach data for every day.

• Our Acceptable Use policy prohibits unauthorised access, harassment and resale.
• Every search is logged to the account that ran it.
• Misuse leads to immediate termination.

From leaks that are already circulating publicly:

• Breach databases — dumps published after a site or service was compromised.
• Credential combolists — email/password lists compiled and traded from earlier leaks.
• Infostealer logs — logins harvested from infected devices, listed next to the exact portal URL.

Our own collection pipeline discovers and ingests them continuously, then normalises, de-duplicates and tags every record with its breach date and origin.

We do not hack, buy stolen data to order, or generate records; we index what is out there so its owners can see it first. Questions about a specific source, or a removal request? Write to privacy@leakhash.com.

A yes/no checker tells you an address appeared somewhere. LeakHash shows the actual record:

• the portal the login belongs to;
• the breach date and origin;
• whether a plaintext password or a hash was exposed;
• across your entire domain, in a clean breach-date-first table with export.

Compared with credit-based tools: flat plans with visible quotas, unlimited searching on Free, and Business Alerts, WHOIS intelligence and the Email Security Audit included rather than sold as paid add-ons.

Eleven search fields, including an “All” mode that searches everything at once:

• Identity: email, username, name, phone number, postal address.
• Credentials: password, hashed password.
• Infrastructure and assets: IP address, VIN.
• Domain scan: every record tied to a company, in one query.

Text fields match partial values; precise fields such as IP and phone match exactly.

1. Add a monitor — a domain, email, username, IP or phone.
2. Every day LeakHash compares everything ingested since the last check against your monitors.
3. On a match you get an email to the account owner plus an in-app notification with a direct link to the exact records.

The response starts the same day, not the next quarter.

• Ingestion: new sources are added continuously.
• Monitors: run daily against everything new.
• Overview: a live feed of the latest published breaches and active threat infrastructure.
• Search: answered from a purpose-built index in milliseconds, even at millions of records — see the measured benchmarks above.

We collect only what the service needs: your email, a hashed password, and your usage and sign-in history for security.

• Passwords are hashed with Argon2id.
• Secrets are encrypted at rest.
• Sessions are revocable from Settings.
• No ads, no third-party trackers, no resale of data.

The full Privacy Policy is on our Legal page. Privacy questions: privacy@leakhash.com.

Yes.

• Individuals can request suppression of records containing their identifiers.
• Verified domain owners can request suppression for their whole domain.
• Law-enforcement and regulator requests are handled through the same channel.

Send requests to privacy@leakhash.com following the process on our Legal page. Suppression also applies to future ingestions of the same values.

No card is needed, and Free never expires. The Free plan gives unlimited searches with the top 50 results per search, three monitors, one verified domain, and your own address monitored automatically.

• Pro — $12.99/month or $119/year, or a 7-day pass for $4.99 that never renews.
• Enterprise — $89/month or $850/year.
• Both unlock full results, CSV export, more monitors and verified domains, and the developer API.

Plans are flat and billed by Stripe. Cancel in one click from the billing portal — access continues to the end of the paid period — and a first paid purchase carries a 7-day money-back window. See the pricing page.

7-day money-back on your first paid purchase (a monthly or yearly plan, or the pass): write to support@leakhash.com from your account email within 7 days of the charge and we refund it in full — no forms, no justification needed.

After that, the cancel-at-period-end model means you are never charged for time you did not intend to use. The full policy is on the Company & Legal page.

Because you can check everything we claim.

• Your address is used for sign-in and the alerts you choose — no marketing, no resale, no trackers.
• You can download all your data and delete your account yourself from Settings, instantly.
• A public status page, a quarterly transparency report and a security.txt contact are published.
• Records never travel by email — the welcome exposure report and alerts carry counts and links only.