InfoBreach
Sign in Create account

Find every record we hold on one identifier.

Enter an email, username, domain, phone number, or address. We search the indexes that accept it and return the records that match. Breach rows arrive with the source they came from and the date that source is dated to.

Create account See what a record holds

accepts email username password full_name ip_address phone_number hash domain

Four indexes, described precisely.

These are the fields each index returns. Where an index does not hold something, it is not listed.

01

Breached credentials

Search a single identifier across our credential records. Each match carries the source it was recovered from and the month that source is dated to, plus the first and last time the identifier appears anywhere in the index.

Query by
email, username, password, full_name, ip_address, phone_number, hash, domain
Each match carries
source.name, source.date
Across the whole result
found, databases, first_seen, last_seen

Standing monitors watch one asset or an entire domain and notify you when it next appears.

02

Social accounts

Hand us one username, email, or phone number and we fan it out across platforms, checking each for a live account. Every hit comes back with what that platform exposes; a platform that does not answer is reported as a failure, not counted as an absence.

Query by
username, email, phone
Platforms reached
581 by username, 18 by email, 5 by phone
Answer per platform
live account, none, or no answer

The resolver reports each platform as it answers, so the count on screen climbs while the search is still running.

03

Compromised device records

also called stealer logs

A record is the full capture from one device, not a single row. Thirteen views read the same archive, nine of them parsed into tables, and the archive itself stays browsable underneath them.

Query by
email, username, domain, password, ip, email_domain
Parsed tables
credentials, cookies, autofills, system, accounts, software, phrases, payments, browser_history
Also on the record
the raw archive, search within the device, AI analysis and chat
Counted for you
unique, corporate, personal, unique_domains, reused_passwords

Credential results arrive with their summary counters in the same response, so totals need no second query.

04

People search

Look a person up by name, phone, address, or email and get the identity assembled from US public filings. Relatives and associates carry their own references, so a lookup continues rather than ending.

Query by
name, phone, address, email
Returned
age, location, current_address, past_addresses, aliases, phone_numbers
Traversable
relatives, associates

Records come back whole on every plan, the free one included, profile drill-in and all: these are published filings rather than leaked ones.

What happens between your query and your results.

Four stages, always in this order. Nothing is queried speculatively and nothing is returned unfiltered.

  1. 01

    Authorize

    Your plan and remaining quota are checked before the query runs. A query you are not entitled to make never reaches our records.

  2. 02

    Resolve

    The identifier is validated against the types that index accepts, then matched across every record it holds.

  3. 03

    Filter

    Matches pass through takedown removal and whatever masking your plan applies, before anything is serialised.

  4. 04

    Return

    One envelope comes back, the same shape either way: the matched records on success, or a message and a machine readable code when something stopped the query.

Every response arrives in the same envelope.

Success or failure, every surface the key reaches answers with the same two shapes, so a client branches on one field instead of parsing prose.

A key is issued on Premium and on team plans, and it covers breached credentials, compromised device records, and people search. No key reaches social accounts: those stay dashboard surfaces, and programmatic access to them is arranged separately rather than sold as a tier.

plan_upgrade_required
The surface exists but your plan does not reach it.
quota_exceeded
Your daily allowance is spent.
hourly_limit
You are querying faster than your plan allows.
feature_not_enabled
The surface is off for your account.
curl https://infobreach.net/api/search \
  -H "Authorization: Bearer $INFOBREACH_KEY" \
  -d '{"type":"email","term":"[email protected]"}'

The reply

{
  "success": true,
  "data": {
    "found": 42,
    "sources": 7,
    "first_seen": "2013-05",
    "last_seen": "2024-10",
    "results": []
  }
}

Provenance, takedowns, and access limits.

The parts of the system worth knowing about before you send a query.

  • Every breach record carries its origin

    Each breach row comes back with the source it was recovered from and the date that source is dated to. The other three surfaces carry provenance too, in fields shaped to what they hold.

  • A censored plan is not a shortened one

    Every plan runs the query for real and returns every row it matched. Where a plan masks a surface the values arrive withheld, but the row count, the structure, and the column names are the true ones. Public records are never masked, on any plan.

  • Some fields are stripped for everyone

    Breach rows can carry government identifiers. We drop that field before serialising, on every plan including the top one: no plan reveals it, no unlock opens it, no key returns it.

  • Takedowns apply to results, not just to records

    An honoured takedown suppresses the row across all four surfaces, and the counts returned beside it are recomputed to match. Two exceptions worth knowing: the catalogue-wide totals we cache by the hour, and monitors, which keep firing on the asset.

  • Where the data reaches us from is not disclosed

    Results name the breached source a row came from, not how that source reaches us. Neither do exports, errors, or answers to asking.

  • Running out returns an error, not a short answer

    Reaching an hourly cap, or spending the allowance for the period, returns an error that says so, never a success holding fewer rows than the query matched. Bulk is the exception: it reports per term, so a batch that stops part way tells you which term stopped it.

InfoBreach

Start with one identifier.

Free runs 25 searches a day across breach and device records, and 25 each for people search and social. Withheld rows unlock five a week, or a paid plan reveals them outright.

Create account View Pricing

Not ready for an account? Check one identifier with no signup. The demo returns a masked sample of what the indexes found.