Breach & Threat Intelligence

The reference database of public data breaches, run by security researcher Troy Hunt. Many other checkers use its data.

• Seeing which breaches an email address appears in
• Free alerts when it shows up in a new breach
• Checking whether a password has leaked, without sending the password

Mozilla's breach alert service, with plain-language advice on what to do after each breach.

• Watching several personal email addresses in one place
• Step-by-step guidance after a breach

SpyCloud recaptures data from criminal sources, including malware-infected computers and successful phishing, not just old breaches.

• Finding out whether your details were stolen by malware
• A broader picture than breach lists alone

A one-off breach check from the Finnish security company F-Secure.

• A private check: the report goes to the inbox you enter, not the screen
• Recommended actions for each breach

Your password manager can check every saved login against known breaches automatically.

• Finding which of your saved passwords have leaked
• Ongoing warnings without signing up for anything new

A search engine over leaked data, dark-web sites, paste sites and historical archives, built for investigators.

• Finding where an email, domain or IP appears in leaks
• Historical copies of pages and documents that have since disappeared

Tracks credentials and data stolen by infostealer malware, today one of the main ways attackers get into companies.

• Checking whether employees' or customers' computers tied to your domain have been infected
• Investigating how an account was taken over

Continuously scans the internet and records which hosts, services and certificates are exposed.

• Mapping an organisation's internet-facing systems
• Certificate and host history during investigations

The best-known search engine for internet-connected devices: servers, webcams, industrial systems, routers and more.

• Finding exposed services and devices by product, port or organisation
• Monitoring your own IP ranges for new exposures

Visits a website in a sandbox and records everything it loads, contacts and shows, with a screenshot.

• Safely inspecting a suspicious link without opening it yourself
• Finding other pages that share infrastructure with a malicious site

Google-owned service that checks files, links, domains and IP addresses against dozens of security engines.

• Checking a suspicious file or link before opening it
• Looking up a file by its hash (see our File Hash Checker)

Tells you whether an IP address is mass-scanning the whole internet, or is a known harmless service.

• Deciding whether an IP in your logs is targeting you or scanning everyone
• Cutting down false alarms

Searches the public logs of every trusted TLS certificate ever issued.

• Finding an organisation's subdomains
• Spotting look-alike domains that got certificates for phishing