7 sites like Have I Been Pwned

Most round-ups compare these sites on how many records they claim. That is the least useful axis, because every vendor counts differently: some index only verified breaches of named services, others fold in combo lists, scraped data and small leaks that would never appear in a curated corpus. A site claiming twice as many records as another may simply have a looser definition of a breach.

Three things separate them in practice. The first is which identifiers you can search. Have I Been Pwned takes an email address. If what worries you is a phone number, a reused username or an IP, most of this list cannot help and two of them can. The second is what the free tier actually returns, which ranges from a complete answer to a count designed to sell you an upgrade. The third is whether you get the breach name or the credential, which is the difference between knowing you were exposed and knowing exactly which password to change.

Have I Been Pwned is the reference implementation, and the honest starting point is that most people never need to leave it. It is free, it does not monetise your search, and its corpus is curated rather than scraped. Verified in July 2026 it covered 1,019 pwned websites and more than 17.7 billion accounts. Pwned Passwords additionally lets you check a single password safely, because it never transmits the full password, only a partial hash.

Its limits are deliberate: email addresses only, no phone numbers, no usernames, and it never shows you a password. For the background on how it works and whether it is safe to search, read our Have I Been Pwned guide.

LeakCheck is the closest thing here to a general-purpose breach search engine. Verified in August 2026 it advertised more than 10 billion leaked records across 1,366+ data breaches, and it accepts email, username, phone, domain, keyword and IP as search terms, which is the widest set on this page.

The catch is the free tier: a free search confirms exposure but hides passwords and limits what you can see, with full access behind a plan. Published pricing at the time of checking ran from US$2.99 for a day through US$9.99 a month to US$69.99 for lifetime access, with an API for automation.

The Cybernews Personal Data Leak Checker is the quickest free second opinion, and the one to reach for if a phone number rather than an inbox is what worries you, since it accepts a number in international format. Verified in July 2026 it claimed 18,611,353,922 breached accounts across 36,030 breached websites, a much larger figure than Have I Been Pwned's because it counts many smaller leaks.

It is a check rather than a monitor: no alerts, no remediation. It is also run by a commercial review site, so expect product recommendations alongside your result.

Mozilla Monitor is the friendliest of the free options. Enter an address, get a scan, and turn on continuous monitoring so you are told when a new breach appears. Mozilla states that its data breach monitoring protection is always free.

Where it beats a raw lookup is presentation: each breach comes with plain-English guidance rather than a bare list. It is email-only, and its paid tier's data-broker removal is United States-focused, so Australians should read our Incogni vs DeleteMe comparison before paying for removal.

DeHashed is aimed at security professionals rather than consumers. It searches usernames, IP addresses and domains as well as emails, sends monitoring notifications by text, email or webhook, and offers API access. Results are raw breach records, and interpreting them is entirely your job.

For a typical person it is overkill. For tracing how far a set of identifiers has spread, it is the deepest self-serve option here. Pricing is usage-based on a credit model rather than a flat subscription.

Intelligence X is a search engine and data archive rather than a breach checker in the narrow sense. It indexes Tor and I2P sites, data leaks and the public web, and its selectors include email addresses, domains, IPs, CIDR ranges and Bitcoin addresses. It also maintains historical snapshots, so it can surface material that has since been taken down.

That archival angle is its real distinction, and also why it is the least consumer-friendly entry here: you need an account to get meaningful results, and reading them assumes you already know what you are looking at. It is a research tool, not a reassurance tool.

Scattered Secrets inverts the usual model: rather than telling you which breach contained your address, it is built around recovering the actual cracked passwords for addresses you have verified you control. Verified in August 2026 it reported 5,078 unique data leaks and 8,498,470,880 unique passwords.

It is subscription-only, starting at €2 per monitored email address per year for personal use and rising steeply for business tiers. The verification requirement is a feature rather than an obstacle: it is what stops the service being a lookup tool for other people's credentials.

Every site on this page answers the same shape of question: has this identifier appeared in data someone leaked? None of them answers the question you actually have afterwards, which is which of my accounts does this affect, and what do I do about each one?

That is not an oversight on their part. A breach database has no idea which accounts you hold, only which breaches contain your address. The accounts you have forgotten about, the dormant ones sharing an old password, the ones holding a saved card, are invisible to all seven. Google made exactly this point when it retired its own Dark Web Report, saying the tool did not provide helpful next steps.

If that is where you are, start with our Have I Been Pwned alternatives guide, which compares tools by the gap each one fills rather than by corpus size, then find the accounts linked to your email and work through them.