Free & open breach-search API

Check any email or domain against 11.6 billion breached records

One GET request, JSON back. No signup and no API key for basic checks. Powering breach alerts for security teams, password managers, and side projects since 2018.

Explore the API docs Integration guide

Every endpoint is a plain GET. You can try this one in your browser right now.

try it, no key needed

$ curl https://api.xposedornot.com/v1/check-email/[email protected]

{
  "breaches": [["Canva", "Tumblr", "Deezer", "VK"]],
  "email": "[email protected]",
  "status": "success"
}

11.65Bbreached records indexed

789data breaches catalogued

836Mexposed passwords tracked

Oct 08, 2026latest breach added

What you can build with it

Every documented endpoint is live in the interactive docs, ready to try straight from your browser.

GET /v1/check-email/{email}

Email breach check

Find out instantly whether an email address appears in any known breach. A plain GET with no authentication, ideal for signup checks and personal alerts.

See it in the docs →

GET /v1/breach-analytics

Breach catalog & analytics

Pull the full catalog of 789 breaches with GET /v1/breaches, covering what leaked, when, and how bad, or get a detailed exposure profile with risk metrics for any email.

See it in the docs →

POST /v1/domain-breaches

Domain monitoring

Verify a domain you own and get breach exposure reports and alerts for every address on it. Built for security teams and IT admins.

See it in the docs →