Check if your email or password has been compromised in a corporate data breach.
This account appeared in publicly circulating data leaks. We recommend immediate remediation.
In May 2016, LinkedIn had 164 million email addresses and unsalted SHA-1 password hashes posted on darknet marketplaces from an intrusion in 2012.
Cloud storage provider Dropbox suffered a credential dump containing 68M unique email records alongside bcrypt and SHA-1 salt hashes.
Australian graphic design platform Canva experienced a breach by hacking group Gnosticplayers containing customer profile metrics and OAuth tokens.
Uses client-side SHA-1 hashing via Web Crypto API. Only the first 5 characters (k-anonymity prefix) are ever checked.
This exact password exists in plain leaked password dictionaries. Never use this credentials anywhere.
CBFDAC6008F9CAB4083784CBD1874F76618D2A97
Billions of credentials and personal records circulate in underground cybercrime forums following major corporate breaches. Checking breach exposure safely without exposing cleartext credentials is essential for proactive account security and identity theft defense.
Use when reviewing corporate email exposures, auditing employee credentials, checking personal email safety, assessing password leakage risks, or investigating historical corporate data leaks.
Yes, 100%. Passwords are never sent across the network. All hashing uses the client-side Web Crypto API (crypto.subtle SHA-1) using k-anonymity principles. Email lookups run entirely in-browser against an embedded offline threat intelligence database.
With k-anonymity, only the first 5 hexadecimal characters of a SHA-1 hash are queried against compromised dictionaries. The remaining hash characters remain strictly in local memory, preventing reverse-engineering of user credentials.
Yes. An optional API configuration modal allows enterprise security engineers to input their HIBP v3 subscription key to query live breach feeds directly.