Email Breach Check

Credential stuffing is the automated replay of stolen email-and-password pairs against unrelated sites. An attacker takes a list of millions of credentials from one breach and tries them against banks, retailers, email providers and social platforms. No guessing is involved. They are just checking whether you used the same password twice.

Success rates per site are tiny, usually a fraction of a percent, and at scale that hardly matters. Ten million credentials at a 0.1% hit rate still gives an attacker ten thousand working accounts. The economics are firmly on their side. The whole thing collapses the moment your passwords are unique.

This is also why the age of a breach matters less than people assume. A password you set in 2016 and still use somewhere is exactly as valuable to an attacker today as one stolen last week.

Breach reports often note whether passwords were hashed. Hashing converts a password into a fixed-length value that cannot be reversed directly, so a breach of properly hashed passwords is considerably less damaging than one of plain text.

The word 'properly' is doing a lot of work there. Older or badly chosen algorithms can be cracked at enormous speed on consumer graphics hardware, so common passwords fall almost immediately. MD5 and SHA-1 are the usual culprits, particularly without a per-user salt. Algorithms designed for the job, such as bcrypt, scrypt and Argon2, are deliberately slow and memory-hungry, which makes mass cracking impractical.

You will rarely be told which was used. The safe assumption is that any password exposed in a breach should be considered known, and changed everywhere it was used.

This check queries XposedOrNot, a free public breach-data service, and returns the breaches it holds for the address you enter, along with the categories of data each one exposed. It is a lookup against an existing catalogue.

It is not a dark web scan, whatever similar tools advertise. Nobody crawls the dark web on demand for a free web form. The phrase describes a search of already-collected data, and it is worth being suspicious of any service that implies otherwise. Private marketplaces, closed forums and breaches that were never published sit outside the scope of every service of this kind, paid or free.

XposedOrNot's dataset is also smaller than Have I Been Pwned, the best-known public breach index. A clean result here is weaker evidence than a clean result there, so checking both is worth the extra minute. All a clean result means is that your address was not found in the breaches this service holds. It does not mean it has never been exposed. A positive result is reliable information. A negative one is the absence of information.

Start with the affected account. Change its password to something unique, then check whether anything in its settings has been altered. Recovery email, forwarding rules, connected apps and payment details are the usual targets, because an attacker with access tends to plant a way back in before doing anything visible.

Then deal with reuse, which is the part that actually matters. Every other account sharing that password is exposed, including the ones you have forgotten about. Work through whatever would hurt most to lose. Email comes first, because it can reset everything else, then banking, then anything holding payment details.

Turn on two-factor authentication wherever it is offered. An authenticator app or a hardware key beats SMS, which is vulnerable to SIM-swap attacks, though SMS is still far better than nothing. Two-factor is what stops a stolen password being enough on its own.

Finally, stop trying to remember unique passwords. A password manager is the only approach that scales past a handful of accounts, and it removes the temptation that causes the problem in the first place.