Questions, answered
without the sales pitch.

You can do it yourself, for free:

1. Create a free account. To remove an email address, sign up with that address. To remove a domain, any address will do.
2. Open Remove My Data (under Account in the sidebar).
3. For your email address, choose Send confirmation link and open the link we email you while signed in. For a domain, enter it, add the DNS TXT record we show you at ld.yourdomain.com, then choose Check DNS.

Once confirmed, matching records are removed from every search, report, export, alert and API result, for every account. From the same page you can ask for the records to be deleted permanently, and delete your Leaked.Domains account if you no longer need it.

Removal covers the leaked datasets: breach data, people data, LinkedIn, Facebook and stealer credentials. Public records such as WHOIS, DNS, certificates and subdomains are not changed.

You need the White-label add-on, available on Researcher, Power User and Enterprise from the Plan tab of your profile.

1. Open User Profile and choose the Report Branding tab.
2. Pick a cover design, then fill in your company name, website, contact email and accent colour.
3. Upload a cover logo and a small logo (PNG or JPEG, up to 2 MB, no SVG). A wide, transparent, tightly trimmed PNG prints best.
4. Check the first-page preview, then press Save.

Every report you generate after that, on the web or through the API, uses your branding. You always edit your own copy of the template, so nobody else's reports change.

Five, and each one uses your accent colour:

• A, Night grid: a dark page with a faint grid and a glow, details in a strip at the bottom.
• B, Paper grid: the same layout on a white page.
• C, Split column: a dark column holds your logo and the report details; the title sits on the white side.
• D, Findings band: shows the result up front, with a band of datasets by severity.
• E, Diamond line: a charcoal page with nested diamond outlines and the title set low.

Choose one on the Report Branding tab of your profile. The About page shows all five.

In Universal Search, choose the Domain data point, search for the domain, then press Generate PDF. Reports you have made before are listed under PDF Reports in the sidebar, ready to download again.

Open the Plan tab of your profile. There are two ways:

• Top-ups are one-time packs of search or API credits, charged once to your saved card. They do not reset each month, and last for as long as your subscription does. On Researcher and Power User, API packs are half size.
• Add-ons raise your monthly allowance for as long as you keep them, up to five of each.

Add the API Access add-on from the Plan tab of your profile. It turns the API on for your account and adds 100 API credits a month. You can then generate a key in your profile, and buy API top-ups if you need more.

Turn on Demo Mode with the eye button in the top bar. Emails, passwords, hashes, phone numbers, IPs and addresses are blurred on screen until you turn it off.

Start a project session from the Session menu in the top bar. Your searches, pivots, canvases and Investigate cases are filed under the active session, and you can switch between sessions or share one with a colleague.

Open Asset Monitor in the sidebar, press Add Asset and enter the domain, email or other asset. Make sure Alerts is on for it. Assets are re-checked every three days and you get an email when something new turns up.

Install it for Chrome or Firefox from the links in the sidebar, and stay signed in to Leaked.Domains in the same browser. Then:

• Press Alt+Shift+L to open the search box. It detects what you typed or pasted (domain, URL, email, IP, ASN, hash and more) and opens the search in your session.
• Right-click a selection or a link to search it, send it to Query Console or Investigate, or pull every indicator out of it.
• Type ld example.com in the address bar.
• Alt+Shift+D searches the site you are on, Alt+Shift+F searches the selection, and Alt+Shift+S scans the page.
• The Workbench turns pasted text or dropped files into a de-duplicated list of indicators, and the Toolkit has DNS, certificate, lookalike-domain, email-header, hash and decode tools that work without an account.

To see how many records each dataset holds for the site you are on, press Connect in the extension and approve it on Leaked.Domains. The connection can only read counts, never records. You can see and revoke connected extensions on the Security tab of your profile.

More than 44.0 billion records drawn from public breaches, infostealer logs, and open infrastructure sources. In practice that means:

• Credentials from breached sites: emails, usernames, passwords and hashes
• Infostealer logs, including the URLs a victim's malware captured
• ULP combolists: URL, login and password lines compiled from infostealer output
• People data, LinkedIn and Facebook datasets
• WHOIS records, DNS history, TLS certificates and subdomains
• Password hashes (MD5, SHA-1, SHA-256, SHA-512, NTLM and LANMAN) mapped to cleartext

New data is added continuously. The Database Info page shows the current record count for every dataset.

All three hold email and password pairs, but they come from different places and tell you different things.

• Leaked Credentials come from the breach of a particular site or service. Each record names the breach and roughly when it happened. Passwords may be clear text or hashes.
• Stealer Logs come from malware on an infected computer. Each credential is part of a full log, so you can open the host and see what else was taken: cookies, cards, wallets, system details and the machine's files. The saved login was recently valid on that computer.
• ULP Combolists are URL, login and password lines compiled from infostealer output. They name the site the login was used on, but there is no host, log or breach behind them, so they show that a login exists and not where it was taken from.

Each one has its own tab in Universal Search, its own count, and its own export. The same credential can appear in more than one of them. Passwords in ULP Combolists follow the same access and masking rules as Stealer Logs for your account type. ULP is searchable by domain, email, username, password and free text.

Breach corpora that are already circulating publicly, infostealer logs posted to open channels, and data we collect ourselves: WHOIS, DNS, certificate transparency logs and subdomain enumeration.

We do not buy data, and we do not breach anyone. Nothing here was obtained by attacking a system. If a dataset is not already in public circulation, it is not in here.

No. It means we have not seen your domain in the data we hold. That is not the same as being secure.

We cover a large but incomplete slice of what exists. A breach may not have surfaced publicly yet, may be held privately, or may never be published. Treat a clean result as one useful signal, not a clean bill of health.

Set up Asset Monitoring on the domain and we will alert you if it appears in something new.

It varies by source. Certificates, DNS and WHOIS update continuously. Breach corpora arrive when they surface publicly, which can be months or years after the incident. Every record carries the date we imported it, and the Database Info page breaks the totals down by year.

Yes, yourself and for free. Create a free account, then use Remove My Data: confirm your email address from a link we send you, or prove you own a domain with a DNS TXT record. Matching records are then removed from every search, report, export and API result, and you can ask for them to be deleted permanently.

Removal covers the leaked datasets (breach data, people data, LinkedIn, Facebook and stealer credentials). Public records such as WHOIS, DNS and certificates are not changed. For anything else, email info@leaked.domains.

Worth being straight with you: removing a record here does not remove it from the breach. The same data is circulating in places with no removal process at all. Removal reduces your exposure on this platform, nothing more.

Security researchers, incident responders, domain owners investigating their own exposure, and law enforcement.

It is not a people-search tool and it is not open to the general public. Higher tiers are reviewed by hand before they are granted.

Yes. A free Demo account lets you run a small number of searches each day with limited results, so you can see whether the platform is useful before paying for anything.

Cleartext passwords, exports, the API and bulk tooling require a paid plan.

Because of what the data is. Open access to breach data is how it ends up being used for credential stuffing and harassment.

Vetting is the trade-off that lets us hold useful data and still sleep at night. It is deliberately slower than clicking "sign up".

Three options, from your profile:

• DNS TXT record: add the value we give you at ld.yourdomain.com. Fastest and most reliable.
• Administrative email: we send a link to admin@, administrator@, hostmaster@, postmaster@ or webmaster@ at that domain.
• Manual review: tell us how you can demonstrate control and we will work it out.

Verifying a domain unlocks cleartext credentials for that domain only.

Yes, for Researcher, Enterprise and Law Enforcement accounts. Set it up from your profile with any authenticator app.

You can also restrict your account to specific IP addresses or ranges from the Security tab.

Yes, from the Security tab of your profile. It is permanent and cannot be reversed. You will be signed out everywhere, your API keys stop working immediately, and remaining credits are forfeited.

You cannot delete an account with an active paid subscription; cancel that first. Records of activity on the platform are retained for accountability.

See the pricing page for current numbers. There is a free Demo tier, self-serve paid tiers, and contact-only access for law enforcement.

Paying yearly is cheaper than paying monthly on every tier.

Your plan comes with three separate pools: search credits for the web interface, API credits for the API, and monitoring credits for Asset Monitor. Plan credits reset monthly and do not roll over. Plans give a daily share of the monthly pool; daily limits can be removed with approval, so contact us if you need yours lifted.

• Searches: one search credit per search you run.
• Passive tools (subdomain, TLD, AS org and hash lookups): one search credit per lookup. A lookup that is rejected before it runs is not charged.
• Exports: one search credit per 1,000 rows (a 10,000-row export is 10 credits).
• API searches: one API credit per 1,000 rows returned, rounded up (a 5,000-row page costs 5 credits).
• Other API calls (dataset counts, password checks, domain lists and report generation): one API credit each. Query counts, table details and BIN lookups are free.
• Monitoring: one monitoring credit per asset, returned when you stop monitoring it.

Credits you buy as a top-up work differently: they do not reset, and last for as long as your subscription does. See How do I get more credits?

Give us something to watch and we re-check it against new data automatically, emailing you when it shows up somewhere new.

You can monitor eight asset types: email, domain, IP or subnet, username, password, password hash, telephone number and ASN. Your plan gives you a single pool of monitoring credits and you spend it on whichever mix you want.

Card, through Paddle, who act as merchant of record and handle tax. Invoices are available in your profile under Billing.

For purchase orders, bank transfer or anything unusual, email billing@leaked.domains.

Cancel any time from your profile. The Cancel Subscription link goes straight to Paddle. You keep access until the end of the period you have paid for.

For refunds, email billing@leaked.domains and tell us what happened. We would rather sort out a problem than keep money from someone the platform did not help.

Yes. Leaked.Domains is operated by Joe Black Security Co. Ltd, a registered company. We index data that is already publicly circulating and sell access to security professionals and domain owners investigating their own exposure.

How you use what you find is on you, and is governed by the law where you are and by our terms.

Fair question. Plenty of sites in this space are. We are a registered company with a named operator, payments run through Paddle rather than an anonymous wallet, and you can talk to us before paying anything.

Start with the free tier and judge the platform on its results.

Accessing accounts you do not own, credential stuffing, stalking, harassment, doxxing, or building a people-search product on top of our data.

We log activity, and accounts that misuse the platform are closed. This is also why access is vetted rather than open.

No. We sell search access, not data. We do not sell, trade or hand over raw datasets, to anyone, at any price.

Exports on paid plans cover the results of your own searches within your plan's limits, not bulk dumps of a database.

Yes. It is included with the API and Enterprise plans, and Researcher and Power User can add it with the API Access add-on from the Plan tab of your profile.

Generate a key in your profile. The endpoints, with examples you can try from the browser, are documented at api.leaked.domains. The API covers search, dataset counts, password checks, domain lists and full PDF report generation, including your white-label branding.

API calls use their own credit pool, separate from web searches, and have their own daily rate limit.

Yes, as CSV or JSON on paid plans. Exports containing cleartext passwords require a higher tier, or a domain you have verified you own.

Cleartext passwords are the most dangerous field we hold, so they are gated twice: your plan has to permit it, and for most accounts it is limited to domains you have proven you own.

If you need broader access for legitimate work, talk to us.

Yes, for Chrome and Firefox. Both are linked in the sidebar. See How do I use the browser extension? for what it does.