vulnbeacon_TOOLS
← All tools

DNS & email

Email breach check

Check an email address you own or have permission to review. With your consent, the address is sent to Have I Been Pwned when you run the check.

Coming soon

How to use Email breach checkSteps, privacy & next steps

Look up an authorized email address through a configured breach provider.

Run this check

  1. Check that the operator has configured a real Have I Been Pwned subscription.
  2. Enter an email you own or are authorized to check, then explicitly consent to sending it to that provider.
  3. Review returned incidents, replace reused passwords and check important account sessions and MFA.

What you need

  • One authorized email address. A configured HIBP API subscription is required.

Your input & privacy

The full email address is sent to Have I Been Pwned only after consent. The result is transient and does not enter the private diagnostic handoff.

Read the result

The current integration returns incident names and response guidance. Follow the affected service's incident instructions and use unique credentials.

Keep in mind

  • Provider coverage and available incidents depend on the subscription. No entries do not prove an address is unexposed.
  • The tool does not log in, inspect a mailbox or confirm a current account compromise.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.