Every tool, and what it's worth.

Your query fans out to several public breach-data services at once. Their answers are normalised into one table, deduplicated, and tagged with the source that produced each row, so you can see which service vouches for what.

Limits — Coverage comes from free public sources: broad, but not exhaustive. A source that rate-limits or goes offline is reported as failed rather than silently dropped from the results.

You seed it with one identifier. It expands that through the leak sources and a set of pivots — a username checked across dozens of sites, an email's public Gravatar profile, a domain's DNS, certificates and registration, and co-mentions on the dark web — then expands what those turn up, in turn, up to a set limit. The same identifier found two ways becomes one node, so what links two findings is there to see. Because a spider scan is kept to your account, a later scan can tell you an identifier already showed up in a search you ran before.

Limits — A paid-plan tool: the free trial can't run it. A whole scan — however many lookups it makes — counts as one search, and each scan is capped in size so it can't fan out without bound. Coverage is only as good as the free sources behind it. Scans are stored to your account until you delete them — the one DECINT tool that keeps what it was asked.

A search goes to many onion search engines at once and the results are merged: the same page found by several engines becomes one result, near-identical pages on different addresses are grouped as mirrors or possible phishing clones, and paid ads, scam listings, dead addresses and typo-squatted look-alikes are dropped. What is left is ranked on relevance, how many independent indexes agree, and a quality score. Fast mode asks the engines that publish a clearnet gateway. Tor mode asks every onion engine, each on its own isolated circuit.

Goes further on Pro — every onion search engine is queried over its own live Tor circuit instead of the few with a clearnet gateway, with entity extraction and an evidence SHA-256 over the result set.

Limits — Onion engines come and go constantly, and many are down at any given moment. Dead ones are benched by a circuit breaker instead of stalling every search. Tor mode takes up to a minute because it is making real circuits. Only search-engine pages are read; the sites in the results are never visited, and searches for child sexual abuse material are refused.

The password is hashed with SHA-1 in your browser and only the hash is sent on. It is looked up through the leakedpassword.com API in Have I Been Pwned's Pwned Passwords — hundreds of millions of real passwords from public breaches — which answers with how many times it has been seen. If that API is unavailable, Pwned Passwords is asked directly, and sees only the first five characters of the hash. A strength estimate is worked out in the browser alongside.

Limits — It says whether a password has leaked, not whether it is safe: one that has never leaked can still be easy to guess. Up to 20 entries per check, which counts as one search. leakedpassword.com receives the full SHA-1 hash; the password itself is never sent anywhere.

Location and network come from DB-IP's databases, held on our own server, so that part of the lookup never leaves it. The registry record is fetched over RDAP from whichever regional internet registry holds the address — ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. Reverse DNS is checked against forward DNS, the address is compared with the Tor Project's current exit list, and its reputation comes from AbuseIPDB's community abuse reports. A hostname or URL is resolved first and each of its addresses looked up.

Limits — IP geolocation is an estimate. It places an address where its network is registered or routed from — a city at best, never a street address — and mobile, VPN and cloud addresses are often placed far from whoever is using them. Private and reserved addresses are recognised and not looked up anywhere.

DNS records come over DNS-over-HTTPS and the mail policy is graded from them: SPF, DMARC and MTA-STS. The registration record is fetched over RDAP from the registry for the domain's TLD. Subdomains come from the certificate-transparency logs, which list every certificate a public CA has issued. Our server fetches the website itself — following its redirects, reading its security headers and title, and checking its TLS certificate — but only ever from public addresses. Hosting is placed with the same databases as IP lookup, and the Wayback Machine says when the site was first captured.

Limits — Most registries now redact the registrant, so the owner's name is usually not there. Certificate logs list names a certificate was issued for, not names that still resolve, and very large domains are shown in part. The website is fetched once from our server, so a site that answers differently by country or blocks automated visitors may look different in a browser.

One query to VeriRoute Intel's number-intelligence API returns the number's routing record from the North American portability database, the serving carrier with the rate center, city, state and ZIP it is homed in, the caller ID name from carrier CNAM databases, the provider that receives its texts, and a reputation score built from spam and robocall complaints. Numbers that cannot exist on the North American plan are caught before anything is sent.

Limits — US and Canadian numbers only. The location is where the number was issued, not where its user is, and it does not move when a number ports or its owner moves. Most mobile numbers have no published caller ID name and read WIRELESS CALLER. Paid plans include a monthly number of phone lookups, each also counting as a search.