what-leaked-about-you

Start with Have I Been Pwned, which verifies and attributes breaches before listing them and labels each with its data classes. For record-level detail or searches by username, phone, or name, use keyed commercial services such as DeHashed, IntelX, or Snusbase.

Use the Pwned Passwords range API: hash the password locally with SHA-1, send only the first five hex characters, and match the returned suffixes locally. The service never learns the password or the full hash.

Have I Been Pwned is curated and returns breach membership and data classes but never credentials. DeHashed is a commercial record-level service supporting multi-selector search that returns actual field values, with broader but less curated coverage.

No. Using a leaked credential to authenticate is unauthorized access under computer-misuse law in most jurisdictions, regardless of how public the dump was. The same prohibition covers password resets and testing reuse on other services.

Combolists are aggregated, deduplicated credential collections stripped of provenance, so a hit cannot be attributed to any specific service. That destroys the service-enumeration value and means the finding should be graded unconfirmed.

No. Absence only means the person's services were not breached, the breach was never published, or the source does not carry it. Non-appearance in any corpus proves nothing about actual exposure.