BREACH CHECKHAS YOUR STUFF LEAKED?

breach.oc
ONION CORE

Companies get broken into. When they do, email addresses and passwords spill into lists that get copied, traded, and tried against other sites. This page checks yours against the public record of known breaches — using the same free lookup services security teams use. We run no server for this page and store nothing.

Password check: your password is scrambled (SHA-1) right here on your device. Only the first 5 characters of that scramble are sent to Have I Been Pwned — never the password, never the whole scramble. The match happens here, on your phone.
Email check: an email lookup has to send the address itself to XposedOrNot's free service, or there's nothing to look up. It goes to them and nowhere else.

🔑 CHECK A PASSWORD

✉️ CHECK AN EMAIL ADDRESS

👁 WATCHLIST — ON THIS DEVICE ONLY

Nothing watched yet. Check an address above, then tap “Add to watchlist”. The list lives in this browser's storage on your device — it is never uploaded anywhere. Re-checking asks the lookup service again, fresh.

IF SOMETHING CAME BACK HIT — THE 3 MOVES

  1. 1 · CHANGE IT. Anywhere you used that password, change it now — starting with your email and anything tied to money. A breached password gets tried everywhere within days.
  2. 2 · MAKE IT UNIQUE. One password per account, no repeats. Reuse is how one site's breach becomes every account you own. A password manager (or the vault in Onion Browser) makes this painless.
  3. 3 · ADD A SECOND LOCK. Turn on two-factor authentication (2FA) wherever it's offered. Even a leaked password can't walk in alone when a second proof is required.

What a hit means: the address or password was inside data that escaped from some service — it does not mean someone is in your accounts right now. It means the raw material is out there, so the 3 moves matter. A clean result means “not in the known public record”, not “impossible”. Sources: Have I Been Pwned Pwned Passwords (k-anonymity range lookup) and XposedOrNot's free email check — legitimate public breach-notification services. This page never downloads, scrapes, or hosts leaked data; it only asks those services whether a value is known.