Instant visibility into underground credential leaks

Searching for credentials tied to your own email, domain or organization is legal everywhere we know of. It's the standard use case for security teams, IT admins and individuals checking their own exposure.

For searches involving third parties (pentesters, bug bounty hunters, threat intel researchers, MSP and MSSP teams), legality depends on your jurisdiction and your contractual scope. We require every user to confirm legitimate use at sign-up, and we don't grant access for malicious purposes. If you're unsure whether your specific use case is allowed, check with your legal counsel.

We also offer free lifetime access to verified law enforcement and military teams.

Yes. If your credentials appear in our database and you want them removed, send a removal request to **privacy@leakradar.io** (or via the contact page) with proof of ownership. We process verified requests within a few working days and remove matching records from search results. This is your right under GDPR Article 17.

Note: removing your records from our index doesn't erase the underlying leak from the internet. The data is already public on multiple forums and channels. It just means it won't show up in LeakRadar searches anymore.

We process credit card payments with Stripe and support 100+ cryptocurrencies through NowPayments.

Unlocking a leak means spending one credit to reveal any usernames or passwords in clear text. Your plan grants you a daily credit quota that renews every 24 hours, so pick the tier that matches your usage.

Yes. Each subscription tier unlocks a fixed number of leaks per day. The counter resets every 24 hours.

LeakRadar supports three search modes. All modes query the same underlying leak database.

- **Email Search** - Query a single address (e.g. alice@example.com) and instantly see every leak containing it.
- **Domain Search** - Map exposure for a whole domain. Results are automatically categorised into:
- Employees - `email_domain = acme.com AND url_domain = acme.com`
- Third-party accounts - `email_domain = acme.com AND url_domain != acme.com`
- Customers - `url_domain = acme.com AND email_domain != acme.com`

- **Advanced Search** - Combine multiple criteria with boolean operators, wildcards and field filters. You can filter on any of the following fields:
`url, url_host, url_domain, url_tld, url_scheme, url_port, username, password, email_host, email_domain, email_tld`

Absolutely. Our REST API is available for both personal and commercial projects - see the docs at https://docs.leakradar.io.

For Python developers we also offer an official wrapper: install it with **pip install leakradar** or check the source on GitHub: https://github.com/LeakRadar/leakradar-wrapper.

Rate limits are 30 req/s for all plans, except for Mass Check endpoints (1 req/s) and Advanced Search endpoints (5 req/s).

No. We only store the timestamp when a leak was indexed, so the date shown is the ingestion date, not the actual breach date.