How we handle your data
Is it safe to check my email for breaches?
Yes, and here is exactly how. The address you check is masked and stored as a one-way hash, so your full email is never kept.
Free, no account needed, and we never ask for a password.
Why typing your email here feels risky, and why it isn't
Most people pause before typing their email into a site they don't know. That caution is sensible, so here is the design choice that answers it.
You should not have to trust us with a full copy of your address just to find out if it turns up in a breach.
So we built the breach check to not store it in full. When you run a check, we turn your address into a one-way hash and keep only a masked version for your record.
A one-way hash cannot be turned back into your email. We cannot read it, and neither can anyone who might ever see our records.
What we keep, and what we never keep
One rule runs through the site: keep as little as possible, and tell you plainly what that is.
A masked address and a one-way hash
For every check we store a masked version of your address and a one-way hash. Your full email is never kept, and a hash cannot be turned back into it.
Alerts start only after you confirm
Breach Watch begins after you click a link we email you. That click confirms you own the inbox before anything is sent.
Take your data or delete it
A free account lets you export everything we hold about you, or close the account and wipe its data, on your own schedule.
No stolen data, no dark web
We don't hold stolen data and we don't scan the dark web. Our records come from breaches that are already public.
We never ask for a password
A breach check needs only an email address. You will never be asked to type a password anywhere on this site.
What happens to the address you check
Follow the address from the moment you type it to the moment you decide what we keep.
You enter an email
You type the address you want to check and nothing else. We never ask for a password, and no account is needed to run a check.
We mask it and make a one-way
The full address is not stored. We keep a masked version and a one-way hash, which cannot be reversed back to your email.
You see your result
The result shows which publicly known breaches the address appears in and what each one exposed, with the steps to take.
Alerts need inbox confirmation
If you turn on Breach Watch, we email a confirmation link first. You confirm you own the inbox before any alerts start.
Your records stay in your control
A free account is optional. If you make one, you can take a copy of what we hold or remove it at any time.
Is it safe to check your email for breaches?
The questions readers ask most before they run a check.
Frequently Asked Questions
- Do you store my email address?
- No. We keep only a masked form of the address and a one-way hash. There is no way to work backwards from that to your real email.
- Is the breach check really free?
- Yes. The check is free and needs no account. There is no paid plan of ours to upsell you.
- What does an empty result mean?
- It means your address was not found in the publicly known breaches we check. It is not proof you were never exposed, so it is worth keeping good habits like strong, unique passwords and multi-factor sign-in.
- Can I download or delete what you hold?
- Yes. A free account gives you a full export of your records and a delete option that removes the account and its data. You decide what stays.
- Why confirm my inbox before alerts start?
- Breach Watch emails could land with anyone, so we send a confirmation link first. Only after you click it do alerts begin, which stops someone signing up an address that is not theirs.
- Do you scan the dark web or hold stolen data?
- No. We do not scan the dark web, and we store no stolen data. What you see is drawn from breaches reported in the open.
Check your email, and see exactly what we keep
Now that you know the method, run the free check. If anything here is unclear, ask us.
The address you check is masked and stored as a one-way hash, never kept in full.