Breach search engines let you look up an email address, a username or a whole company domain in leaked data, and see which credentials are exposed. They differ a lot in what they index, who they are built for and how they are sold. This comparison covers six well-known tools (LeakCheck, Intelligence X, DeHashed, Snusbase, SpyCloud and Hudson Rock) and our own product, LeakRadar.
How we compared. We publish LeakRadar, so we are not neutral. Every statement about another product comes from that vendor's own public website or documentation, checked on 15 October 2026 and linked in the sources at the end. This is not an independent benchmark of data coverage or detection speed, and a feature missing from a vendor's public pages is not proof that it does not exist. Offers change: check the vendor's site before you buy.
What to compare
- Data sources. Database breaches, combolists, infostealer logs and forum content are different datasets. Stealer logs matter especially for companies, because they pair a password with the exact login page (see What are stealer logs?).
- Search types. Email and username lookups are standard. Domain search, password or hash search and full-text search are not.
- Domain categories. Can the tool separate your employees from your customers and from work accounts on third-party services?
- Monitoring. Which assets can be watched, and where do alerts go?
- API access. Included in self-serve plans, or reserved for enterprise contracts?
- Pricing model. Public self-serve prices, or a quote after a sales call?
Comparison at a glance
| Tool | Main data | Domain search | Monitoring | API | Pricing model |
|---|---|---|---|---|---|
| LeakCheck | Breach data, infostealer logs | Enterprise plan | Monthly plan and above | Pro API from the Monthly plan; limited free public API | Self-serve, public prices |
| Intelligence X | Leaks, combolists, stealer logs, darknet, pastes, web archive | Yes (Identity Portal) | Email alerts | Depends on the licence | Yearly licences, public prices |
| DeHashed | Breach data, WHOIS | Domain Scan | Yes; domain monitoring is a paid add-on | Pay-per-query credits, with a search subscription | Self-serve, public prices |
| Snusbase | Database leaks, combolists, cracked hashes | Domain search type in the API | Not described on public pages | Included for paying members | Prices not public |
| SpyCloud | Breaches, infostealer data, phishing, combolists, cookies | Yes (workforce and consumer products) | Watchlist, webhooks, SIEM and identity integrations | Included with every licence | Quote-based |
| Hudson Rock | Infostealer data | Yes: employees, users and clients, third parties | Email, Slack, webhooks and more | Enterprise offer | Quote-based, free tools |
| LeakRadar | Stealer logs with URLs, combolists, raw leak files, forum posts | Yes: employees, third parties, customers | Email, Slack, Discord, Telegram, webhook | Paid plans, plus a Python SDK | Self-serve, public prices |
The tools in detail
LeakCheck
What it is. A self-serve lookup service covering breach databases and infostealer logs.
- Search: email on every plan; username and keyword from the Monthly plan; reverse search by password and domain, and stealer-log search, on Enterprise.
- Monitoring: from the Monthly plan, with alerts by Telegram, email, Slack, Discord or webhooks. Domain monitoring is part of Enterprise.
- API: the Pro API comes with the Monthly, Lifetime and Enterprise plans; a free public API returns only breach sources and data categories.
- Access: public prices, from a one-day Basic pass (email search only) to a Monthly plan at $9.99 per month and Enterprise from $179 per quarter.
Best for: quick, low-cost lookups of individual emails or usernames. Read our LeakRadar vs LeakCheck comparison.
Intelligence X
What it is. A broad search engine and data archive: data leaks, combolists, stealer logs, Tor and I2P content, pastes, WHOIS and DNS data, and a historical archive of the public web.
- Search: selectors such as email, domain, URL, IP address, phone number or cryptocurrency address, rather than free-text names.
- Domain search: the Identity Portal exports leaked accounts for a domain or an email.
- Monitoring: email alerts, daily, weekly or monthly, with a number of alerts that depends on the licence.
- Access: yearly licences with public prices, from €2,500 per year (Researcher). Free tiers exist, but leak and stealer-log data is reserved for paid users.
Best for: investigators who need a wide historical archive beyond credentials. Read our LeakRadar vs Intelligence X comparison.
DeHashed
What it is. A breach data search engine with WHOIS tools (current, historical and reverse).
- Search: email, username, IP address, name, address, phone, VIN, and a Domain Scan option.
- Monitoring: emails, phones, usernames and domains, with notifications by email, SMS or webhook. The free monitoring tier has no webhook, and domain monitoring is a paid add-on.
- API: pay-per-query credits, which require a search subscription.
- Access: public self-serve prices, from $6.99 for one week of search access. DeHashed states that it tries to avoid plain-text passwords as much as possible.
Best for: people investigations that combine breach records with WHOIS data. Read our LeakRadar vs DeHashed comparison.
Snusbase
What it is. A search engine for database leaks, combolists and previously cracked password hashes.
- Search: email, username, IP address, password, hash, name and domain, with wildcards in the API, plus combo, hash and WHOIS lookups.
- Results: Snusbase advertises plain-text, uncensored results for paying members.
- API: included for paying members, within a request limit.
- Access: prices are not shown on its public pages; the purchase page requires an account.
Best for: researchers who want raw breach records and hash lookups through an API. Read our LeakRadar vs Snusbase comparison.
SpyCloud
What it is. An enterprise identity threat protection platform, with data from breaches, infostealer malware, phishing kits and combolists, including session cookies.
- Products: separate offers for workforce protection (priced by employee accounts) and consumer protection (priced by customer accounts).
- Monitoring and remediation: a watchlist of domains, emails and IPs, webhooks, and integrations with SIEM, SOAR and identity providers for automated remediation.
- API: included with every licence.
- Access: no public prices; pricing depends on the solutions purchased. A free domain exposure check is available with a business email.
Best for: large organisations that want automated remediation inside their identity stack. Read our LeakRadar vs SpyCloud comparison.
Hudson Rock
What it is. A cybercrime intelligence company focused on infostealer data, with its Cavalier platform.
- Search: domain, company, keyword in URL, email, username, password, IP address, machine name and more.
- Domain categories: compromised employees, users and clients, and third-party credentials.
- Monitoring: email by default, with Slack, Splunk, Torq and custom webhooks supported. A free account can track up to three emails, three domains and three usernames.
- Access: enterprise offer on request, alongside free tools and the free account.
Best for: teams that want infostealer intelligence with infection context and enterprise support. Read our LeakRadar vs Hudson Rock comparison.
LeakRadar
What it is. A credential exposure search engine and monitoring service built around stealer logs, run by a French company and hosted in the EU. Full disclosure: this is our product.
- Data: stealer-log credentials with the URL of each login, combolists, the original leak files (Raw) and posts from hacking and leak forums. Only data already published in the open is indexed.
- Search: email or username, domain, advanced search with field filters, full-text search inside raw files, and forum search.
- Domain categories: every domain search is split into Employees, Third parties and Customers.
- Monitoring: emails, domains, and advanced, raw or forum searches, with alerts by email, Slack, Discord, Telegram or webhook, and optional auto-unlock of new results.
- API: REST API on paid plans, an official Python SDK, and a free browser extension.
- Access: searching is free and shows match counts; revealing a credential costs 1 point on a paid plan. Public self-serve plans start at 29.99 € per month (Starter); combolists and forum search require Enterprise, and raw file search Platinum.
Best for: security teams that want to search and monitor their own domain, sort exposure by employees, suppliers and customers, and automate alerts without a sales cycle.
Which one should you choose?
- You need a quick check on a few email addresses: a low-cost lookup service such as LeakCheck or DeHashed is enough.
- You investigate people or infrastructure beyond credentials: Intelligence X's archive and DeHashed's WHOIS tools cover more ground.
- You want raw breach records through an API: Snusbase is built for it.
- You need enterprise remediation integrated with your identity provider: SpyCloud and Hudson Rock sell this through a sales process.
- You want to see and monitor your own domain's exposure, by category, with public pricing: LeakRadar lets you start with a free search and a domain search, then add monitoring when you need it.
Frequently asked questions
Are breach search engines legal?
The legal framework depends on the country, the data and the use. Whatever the tool, only search assets you own or are explicitly authorized to assess, and check the provider's terms. LeakRadar only indexes data already published in the open and restricts some sensitive targets by default.
Are any of these tools free?
Several offer free entry points with limits: free lookups or tiers at LeakCheck, Intelligence X and DeHashed, free tools and a free account at Hudson Rock, a free exposure check at SpyCloud, and free searches with match counts at LeakRadar. Full access to the credential data generally requires a paid offer.
What is the difference between breach data and stealer logs?
Breach data comes from a company's compromised database. Stealer logs come from infected personal computers and contain the passwords saved in the browser, each with the website it belongs to. Our explainer on stealer logs covers the difference in detail.
Sources
Vendor pages consulted on 15 October 2026:
- LeakCheck: pricing, API overview, search types
- Intelligence X: products and licences, getting started, Identity Portal
- DeHashed: search plans, monitoring, API, WHOIS
- Snusbase: homepage, API documentation
- SpyCloud: data, pricing, API
- Hudson Rock: homepage, Cavalier, API documentation
Compare on your own domain. Create a free LeakRadar account and see how many credentials match your company before choosing a tool.