Have I Been Pwned alternatives
Have I Been Pwned (HIBP), run by Troy Hunt, is the best-known free service for checking whether an email address appears in a data breach. Alternatives include Mozilla Monitor, XposedOrNot, LeakCheck, Intelligence X and DuckINT; they differ in which breach and infostealer data they index, how much detail they show, and what is free.
The options compared
| Service | What you get | Cost |
|---|---|---|
| Have I Been Pwned | Breaches that include your email, breach notifications, Pwned Passwords | Free search; paid API for programmatic lookups |
| Mozilla Monitor | Breach alerts for your email, built on HIBP data | Free |
| XposedOrNot | Breach list and exposure analytics for an email | Free |
| LeakCheck | Breach and leak search by email, username and more | Free public check; paid plans for full results |
| Intelligence X | Archive search across leaks, darknet and documents | Limited free tier; paid plans |
| DuckINT | One search across several breach and infostealer indexes plus DNS, RDAP and public profiles, each result sourced | Free plan; paid plans from $5 |
How to choose
- Only want to know whether your email was in a breach, and get alerts? Have I Been Pwned or Mozilla Monitor.
- Want breach analytics without signing up? XposedOrNot.
- Want to see which sites your credentials were stolen from by infostealer malware, alongside breaches? A search that includes stealer-log indexes, such as DuckINT.
- Investigating a username, domain or IP as well as an email? A multi-source OSINT search such as DuckINT.
What to do when a check finds your email
- Change the password of every breached service you still use, and anywhere you reused it.
- Turn on two-factor authentication, preferably an authenticator app or a security key.
- If an infostealer log lists your accounts, scan the infected device and sign out of all sessions: the malware may also have taken session cookies.
Questions
- Is there a free alternative to Have I Been Pwned?
- Yes. Mozilla Monitor and XposedOrNot are free, and DuckINT has a free plan that searches several breach and infostealer indexes at once.
- Why does one checker find my email and another does not?
- Each service indexes different breaches and leak collections, and adds them at different times. Checking more than one source gives a fuller picture; no single index has every breach.