Free domain breach check
Check your company domain for leaked logins.
We search 44 billion stealer-log records and 808 breached databases for logins that use your domain. It's free, there's no signup, and it never shows passwords.
What the report shows
How many logins leaked
Every leaked record that uses your domain, and how many separate accounts they belong to.
Your own systems
Logins for websites on your own domain, such as single sign-on, VPN and webmail pages, listed by hostname. These are the ones to act on first.
Infected devices or password lists
How many records came from stealer logs, copied off infected computers, and how many from leaked password lists.
Where else your staff leaked
The third-party sites and apps your people signed up to with a work address.
When it was posted
Twelve months of postings, and how long ago the newest record appeared.
A real sample
A few of the actual records, with email addresses partly masked and passwords withheld.
Free check or full results
| Feature | Free check | With a plan |
|---|---|---|
| Number of leaked records and accounts | Yes | Yes |
| Your own systems and third-party apps involved | Yes | Yes |
| Sample of records, emails masked | Yes | Yes |
| Every record, with the password | No | Yes |
| Search by email, username, password, IP address or website | No | Yes |
| Saved domains, team workspace and API | No | Yes |
Plans start at $124 a month billed yearly, with the API and unlimited seats included. See pricing.
If your domain shows up
Start with the logins for your own systems, then anything posted in the last few months. A login from a stealer log usually means a device is infected, so a password reset isn't enough on its own. Here's what to do in the first 24 hours.
Questions
Is the check really free?
Yes. It costs nothing and you don't need an account. It shows a summary of what we hold for your domain so you can decide whether the full results are worth paying for.
Do I have to own the domain?
No, you can check any company domain. Because anyone can, the free report never shows passwords or full email addresses. Full results are only released to the company that owns the domain.
Can I check my personal email address?
Not usefully. The check works on company domains, and searching gmail.com or outlook.com tells you nothing about your own account. For a personal address, use Have I Been Pwned.
How is this different from Have I Been Pwned?
Have I Been Pwned is a good free first step. To see a domain's results there you have to verify you own it, and it never shows passwords. Our check needs no verification and also shows which of your own sign-in pages the logins were for. The paid plan includes the passwords, so you can tell which logins still work.
Is my search private?
We store each domain's result for 24 hours so that checking it again doesn't run a new search. Anyone who checks the same domain in that time sees the same summary.
How current is the data?
New stealer logs and breach dumps are added every day. A result is reused for up to 24 hours, and after that a check runs a fresh search.