Domain & Email Breach Checker — Have I Been Pwned

What does Domain Breach Checker do?

Domain Breach Checker is a fast, automated domain breach checker and data breach lookup tool built on Have I Been Pwned (HIBP) — the world's largest and most trusted public breach database. It works as a comprehensive HIBP domain scanner that returns the full breach database export (600+ breaches, no API key needed), domain-level breach detection showing which employee accounts were exposed, and per-email breach lookups. All results are structured JSON ready for compliance reports, SIEM pipelines, or automated monitoring workflows.

Why use Domain Breach Checker?

Security teams, compliance officers, and risk managers choose this actor because it delivers enterprise-grade breach intelligence at a fraction of the cost of commercial platforms.

• CISO compliance reporting — Generate breach exposure reports for ISO 27001, SOC 2, and GDPR audits in minutes rather than days. The actor returns every breach record with data types, dates, and affected counts.
• Third-party vendor risk — Check whether a vendor's domain appears in known breaches before signing a contract. A single domain check costs $0.01 versus $10,000+/year for commercial platforms.
• Employee credential monitoring — Detect when staff email addresses appear in newly disclosed breaches before attackers can exploit leaked passwords for credential stuffing attacks.
• Incident response — When a breach is announced, immediately determine whether your organization's domains or emails are among the affected accounts.
• M&A due diligence — Assess a target company's breach history to quantify cybersecurity risk and negotiate deal terms accordingly.

How to use Domain Breach Checker

1. Click Try for free on the Apify Store listing.
2. To export the full breach database (no key needed): leave checkAllBreaches: true and run. You get all 600+ breaches with metadata, data types, and affected counts.
3. To check specific domains: add your HIBP API key in hibpApiKey and list domains in domains.
4. To check specific emails: add your HIBP API key and list addresses in emails.
5. Optionally filter with dataClasses (e.g. ["Passwords"]) or breachAfterDate (e.g. "2022-01-01").
6. Click Start and download results as JSON or CSV.

Input

Field	Required	Default	Description
checkAllBreaches	No	true	Fetch full HIBP breach database (600+ breaches, free — no API key)
domains	No	—	Domains to run domain breach lookup against (requires hibpApiKey)
emails	No	—	Email addresses to check individually (requires hibpApiKey)
hibpApiKey	No	—	HIBP API key for domain and email lookups ($4/month at haveibeenpwned.com)
dataClasses	No	—	Filter breaches by data type: Passwords, Credit cards, Phone numbers, etc.
breachAfterDate	No	—	Only return breaches after this date (YYYY-MM-DD)

Example Input

{
  "checkAllBreaches": true,
  "domains": ["yourcompany.com", "vendor.io"],
  "emails": ["cto@yourcompany.com"],
  "hibpApiKey": "your-key-here",
  "dataClasses": ["Passwords"],
  "breachAfterDate": "2020-01-01"
}

Output

The actor pushes up to four record types to the dataset.

breach_record — full database scan

{
  "type": "breach_record",
  "Name": "Adobe",
  "Title": "Adobe",
  "Domain": "adobe.com",
  "BreachDate": "2013-10-04",
  "PwnCount": 152445165,
  "Description": "In October 2013, 153 million Adobe accounts were breached...",
  "DataClasses": ["Email addresses", "Password hints", "Passwords", "Usernames"],
  "IsVerified": true,
  "IsSensitive": false
}

domain_result — from domain breach check

{
  "type": "domain_result",
  "domain": "yourcompany.com",
  "status": "breached",
  "total_accounts_breached": 47,
  "breach_names": ["Adobe", "LinkedIn", "Dropbox"],
  "sample_emails": ["alice@yourcompany.com", "bob@yourcompany.com"]
}

Data fields

Field	Description
Name	Internal breach identifier
Title	Human-readable breach name
Domain	Domain associated with the breached service
BreachDate	Date the breach occurred (YYYY-MM-DD)
PwnCount	Number of accounts compromised in this breach
DataClasses	Types of data exposed (passwords, emails, phone numbers, etc.)
IsVerified	true if HIBP has independently verified the breach data
IsSensitive	true if the breach involves sensitive categories
status	For domain/email results: breached or clean
total_accounts_breached	Count of accounts at that domain found across all breaches
breach_names	List of breaches where the domain's accounts appear

Cost estimation

Feature	Unit Cost	Example
Actor start	$0.001	One-time per run
Full breach database export	$0.002 per breach record	600 breaches ≈ $1.20
Domain breach check	$0.01 per domain	10 domains = $0.10
Filtered export (passwords only, post-2022)	$0.002 per record returned	~100 records ≈ $0.20

Compare to commercial alternatives:

Tool	Cost
DarkWebID	$20+/user/month
Recorded Future	$25,000+/year
SpyCloud	$10,000+/year enterprise
This actor	Pay only for what you check

FAQ

Do I need a paid HIBP API key to use this? The full breach database export (600+ breach records with metadata) is completely free — no API key required. A HIBP API key ($4/month) is only needed for domain-level lookups (which accounts at your domain were exposed) and per-email checks.

Does the actor expose actual passwords from breaches? No. Have I Been Pwned does not expose raw password data — only metadata about breaches including which data types were compromised, the date, affected count, and breach description. This is by design to protect users while still enabling exposure monitoring.

Can I schedule this for ongoing monitoring? Yes. Use Apify's built-in scheduler to run this actor weekly or monthly against your domain and email list. Connect Apify webhooks to push new breach alerts to Slack, email, or your SIEM automatically whenever new exposures are detected.

---

Data source: Have I Been Pwned created by security researcher Troy Hunt. HIBP is trusted by Microsoft, 1Password, the Australian Signals Directorate, and the UK National Cyber Security Centre. HIBP does not index all dark web dumps — some breaches may not appear in the database.

---

Related actors

• Domain Attack Surface Suite — SSL, subdomain enumeration, and breach check in one comprehensive security audit
• npm Package Security Scanner — JavaScript dependency vulnerabilities to pair with domain breach history for full stack security view
• DeFi Hack Monitor — Protocol-level exploit history for crypto projects whose domains you are breach-checking

Feedback

If this actor helps your security research, a review helps others find it: Leave a review on Apify Store