Read this first

This is a self-defence tool: find where your own identifiers are exposed, then go get them removed. Running it against someone else is the harm it was built to fight.

Search only your own data, or data you're allowed to check.
It shows only what's already public or already in a known breach.
It never reveals anyone's password. The password tab only tells you if one you type is in a breach list.
Nothing is stored, logged, or sent anywhere but the sources being queried.

Exposed

An investigation console for your own digital footprint.

autousernameemailpassworddiscord id

starting

Account checks hit ~220 sites live plus the real public APIs of GitHub, Reddit, Roblox, Bluesky, GitLab, Chess.com and Hacker News. Breach data from XposedOrNot and Have I Been Pwned. Passwords checked by hash prefix — the password never leaves your device readable. Sites that block automated checks (Instagram, TikTok, X, Facebook) are left out because they'd only ever say "blocked". A clean result means nothing catalogued yet — not proof you're safe.