Give Every Business the Visibility Attackers Already Have.
Criminals trade leaked credentials in bulk, sorted by the company portals they unlock. The organisations affected are usually the last to know. LeakHash exists to close that gap: continuously collect what is circulating, make it searchable and understandable, and alert the owners so they can act the same day.
The LeakHash Algorithms
We designed our own collection and analysis pipeline rather than reselling someone else's index. It is what keeps results fresh, consistent and free of duplicates — and it runs around the clock.
1 · Collect
New dumps, combolists and infostealer logs are pulled in as they surface, so the index reflects what is circulating now, not last year.
2 · Analyse
Every line is parsed into typed fields, normalised and de-duplicated. Lines that do not fit a record shape are dropped, never guessed.
3 · Index
A purpose-built index answers exact lookups and partial matches — a domain scan, hash lookup or name search in well under a second.
4 · Alert
Daily monitors compare each new batch with your watch-list; alerts carry the records, breach dates and sources.
Defenders First
LeakHash is built for people protecting organisations and investigating abuse: security and IT teams, managed service providers, incident responders, fraud and OSINT analysts — and individuals who want to understand what a breach actually exposed about them.
Whether you look after one domain or hundreds, the workflow is the same: search, understand, monitor, act.
Responsible Use
Principles We Operate By
- ✓Authorised use only. Search accounts and domains you own or are engaged to assess. Our Acceptable Use policy prohibits harassment, credential stuffing and any unauthorised access.
- ✓Accountability. Every search, export and API call is recorded against the account that made it, with rate limits and plan quotas on every endpoint.
- ✓Privacy-first operation. No advertising, no third-party trackers, no resale of data. We collect the minimum needed to run the service and publish exactly what that is.
- ✓A channel for removal. Individuals can request removal of their records and law-enforcement can reach us through the process in section 5 below.
A Named Operator, Not a Mailbox
Breach-search services have a habit of hiding behind anonymous registrations. We think the people whose data may be in an index deserve to know who is holding it, how to reach them, and what they promise. That is why the operator is named here, why a quarterly transparency report (below) is published, why a live status page shows what is running, and why a security contact is published in security.txt.
- Support: support@leakhash.com — customers, billing, product questions. We reply within one business day.
- Privacy, removal, legal, security: privacy@leakhash.com — data-removal and GDPR requests, law-enforcement process, vulnerability reports.
What We Log, Keep, Share and Are Asked For
A breach-search product is only worth trusting if it is open about itself. Updated every quarter — the first report publishes at launch.
Everything Is Attributed, Nothing Is Sold
- Every search, export, WHOIS lookup, API call, monitor and domain is recorded against the account that made it.
- Each sign-in records IP and browser; sessions are visible and revocable in Settings.
- Records you view are never stored in your browser, emailed, or shared with another account.
- No analytics trackers, no advertising pixels, no third-party scripts. The only cookie is the session cookie.
- You can download everything we hold about your account and delete the account yourself, instantly.
- Removal and law-enforcement request counts are published here every quarter, including requests we declined.
Retention & Sub-processors
| Data | Kept |
|---|---|
| Account data | account + 30 days |
| Sign-in & audit logs | up to 12 months |
| Usage counters | 90 days |
| Support tickets | 24 months |
| Backups | 30-day rollover |
| Provider | Purpose |
|---|---|
| Stripe | Payments & subscriptions |
| Email delivery provider | Transactional email |
| Hosting provider | Application hosting |
Each is bound by a data-processing agreement. No other third party receives customer data.
Terms, Acceptable Use & Privacy
One page, plain language. Using LeakHash (the “Service”) means you agree to everything below. Last updated 01 October 2026.
1.Terms of Service
What the Service is. LeakHash provides search, monitoring and domain-intelligence tools over publicly circulating breach data and public DNS/registration records, for security, compliance and investigative purposes.
Your account. You must be at least 18, provide a real email address that you control, keep your password confidential and remain responsible for everything done with your account and API keys. One person per account; organisations may hold several accounts.
Fair use and limits. Every plan has published quotas (searches, results, exports, monitors, verified domains, lookups, API requests). We may throttle or suspend accounts that circumvent limits, share credentials or automate the web interface instead of using the API.
Verified domains. Domain reports are only provided to accounts that have proved control of the domain through the DNS challenge. Publishing the challenge record for a domain you do not administer, or removing another party's record, is a breach of these terms.
No warranty; limitation of liability. Breach data originates from third parties and may be incomplete, outdated or inaccurate. The Service is provided “as is” without warranties of any kind. To the fullest extent permitted by law, our total liability for any claim relating to the Service is limited to the amount you paid us in the 12 months before the claim.
Termination. You may delete your account at any time from Profile Settings; deletion is immediate and permanent. We may suspend or terminate accounts that breach these terms or the Acceptable Use policy, or where required by law, and will tell you why unless we are legally prevented from doing so.
Changes. We may update these terms; material changes are announced in-app at least 14 days in advance. Continued use after that date is acceptance.
2.Plans, Refunds & Cancellation
Free plan. The Free plan is permanent. It has no trial period and never expires; it is limited by results shown per search and by the published monitor, domain and lookup allowances, not by time.
Subscriptions. Pro and Enterprise renew automatically, monthly or yearly, until cancelled. Prices are shown before tax; applicable tax is calculated at checkout by Stripe. Upgrades take effect immediately and are prorated.
7-day pass. A one-off purchase that unlocks Pro limits for seven days from activation. It does not renew and no card is kept on file with us. When it ends the account returns to the Free plan; nothing is deleted.
API credit packs. One-off purchases of developer-API requests, used only after the monthly plan allowance is spent. Credits do not expire while the account exists and are not transferable.
Cancellation. Cancel any time from the billing portal in one click. Cancellation takes effect at the end of the paid period; you keep full access until then and are not charged again. Downgrading or cancelling never deletes monitors, domains, history or settings.
Refunds. Your first paid purchase (a monthly or yearly plan, or the pass) carries a 7-day money-back guarantee: email support from your account address within 7 days of the charge and it is refunded in full. Later renewals are covered by the cancel-at-period-end model instead. Accounts terminated for Acceptable Use violations are not refunded. Statutory consumer rights in your country are unaffected.
3.Acceptable Use Policy
LeakHash exists to help defenders. You may use it only for lawful purposes and only in relation to accounts, systems and domains that you own or are explicitly authorised to assess. In particular you must not:
- Access, attempt to access, or facilitate access to any account, system or service using credentials found through the Service.
- Use data from the Service to harass, stalk, intimidate, extort, discriminate against or otherwise harm any person.
- Resell, republish or redistribute records, or build a competing dataset from exports or API responses.
- Scrape, mirror or bulk-download the Service, evade rate limits or quotas, or share account credentials or API keys.
- Use the Service in violation of applicable privacy, data-protection, computer-misuse or export-control laws.
- Misrepresent your identity or authority when creating an account or making a request to us.
We investigate reports of misuse, keep audit logs of searches and exports, and cooperate with lawful requests from authorities. Violations lead to immediate suspension.
4.Privacy Policy
What we collect about you. Your email address and a hashed password; billing details held by Stripe (we never see card numbers); verified domains, exports and API usage; the IP address and browser of each sign-in (for security and the sign-in history you can see in Settings); support messages you send us.
Your own address. When you verify your email we automatically create a monitor for it and send you one exposure report (a count and a link, never the records). This is the core of the service; you can pause or delete the monitor at any time.
Why. To provide the Service, enforce plan limits and the Acceptable Use policy, secure accounts, process payments, respond to support and meet legal obligations. Our lawful bases are contract, legitimate interests (security, abuse prevention) and legal obligation.
What we do not do. No advertising, no analytics trackers, no sale of personal data, no profiling for marketing. Emails are transactional only (verification, alerts, billing, security).
Breach data in the index. The records you search originate from third-party leaks that are already circulating publicly. We process them to help affected people and organisations discover and remediate exposure. Individuals may request removal of their records (section 5).
Retention. Account data for the life of the account and 30 days after closure; sign-in and audit logs up to 12 months; usage counters 90 days; support tickets 24 months. Backups roll over within 30 days.
Security. Argon2id password hashing, encrypted secrets at rest, TLS everywhere, strict rate limiting, sandboxed services and least-privilege database roles. No system is perfect; if we ever discover a breach affecting your data we will notify you without undue delay.
Your rights. Depending on where you live you may access, correct, export or delete your personal data, object to or restrict processing, and complain to a supervisory authority. Export and deletion are self-service in Profile Settings (instant); for anything else contact us (section 7) and we answer within 30 days. A quarterly transparency report lists the requests we receive.
Processors. Stripe (payments), our email delivery provider (transactional email) and our hosting provider. Each is bound by a data-processing agreement.
5.Data Removal & Law-Enforcement Requests
Individuals. If your personal data appears in the index, email us from the address concerned (or provide reasonable proof of control for other identifiers) with the exact values to remove. We suppress matching records from search results within 10 business days and confirm by email. Suppression also applies to future ingestions of the same values. Security researchers can report vulnerabilities to the same address; the machine-readable contact is our security.txt file (RFC 9116).
Organisations. Domain owners can request suppression of records for their domain after verifying control (DNS TXT record or admin mailbox). Note that suppression hides the records from all users, including your own monitoring.
Law enforcement and regulators. We respond to valid legal process served through the contact below, and to emergency requests involving imminent risk to life. We require requests on official letterhead identifying the legal authority, the specific data sought and the account or identifiers concerned. We notify affected users where the law permits.
6.Cookies
We use a single strictly-necessary cookie: the session cookie that keeps you signed in (HttpOnly, Secure, SameSite). No analytics, advertising or third-party cookies are set. Your theme preference is stored in your browser's local storage and never sent to us.
7.Contact
- Legal, privacy and removal requests: privacy@leakhash.com
- Support: support@leakhash.com or the Support page in your account.
Please include your account email for anything account-related.
See what's already out there about your domain
Run your first domain scan in under a minute. Free, no card, unlimited searches.