Private exposure check + takeover triage

Email Breach & Credential Stuffing Checker

Check an address against a breach export locally, then assess password reuse, unexpected codes, login alerts, recovery changes and hidden inbox rules.

Processing stays in your browser

Email address

Optional: import breach CSV/TXT locally

Stays in your browser

Accepted rows: email, email + source, or SHA-256(email) + source.

What have you observed?

I reused a password on another siteI received unexpected OTP/MFA promptsI received password-reset notices I did not requestI saw an unknown login or active sessionRecovery email/phone was changedI found an unknown forwarding or inbox ruleI was unexpectedly locked out

Optional breach or security notice

What this checker proves

Exact local matching

Your imported file and address are compared on this device.

Absence is limited

“Not found” means only not found in the checked file—not never breached.

Credential-stuffing sequence

Reused password → automated login → MFA prompts → session persistence → inbox-rule abuse.