Audits whether emails and passwords appear in known data breaches, querying multiple sources and exporting a CSV — useful for exposure assessments and security awareness.
BreachHunter checks each email against several breach databases and validates passwords against the Have I Been Pwned range API using the k-anonymity model, so a full password is never sent over the network. It takes a single value or a list, and writes a clean report you can hand to a client or a team.
- Multiple sources — Breached.me, LeakCheck.io and HIBP Pwned Passwords
- k-anonymity password check — only a hash prefix leaves your machine
- Batch mode — process thousands of emails from a
.txtfile - Email validation — format-checked before any request
- Rate limiting — configurable delay to respect the APIs
- CSV reports — plus optional log file and silent mode
git clone https://github.com/CHDevSec/BreachHunter.git
cd BreachHunter
pip install requestspython3 checker_emails.py [options]| Option | Description |
|---|---|
--email ADDRESS |
Check a single email |
--file FILE.txt |
Check a list of emails (one per line) |
--password VALUE |
Check a password against HIBP (k-anonymity) |
--output FILE.csv |
Output CSV (default resultado_emails.csv) |
--sleep SECONDS |
Delay between requests (default 1.5) |
--log FILE.log |
Write a log file |
--silent |
Suppress console output |
python3 checker_emails.py --email someone@example.com
python3 checker_emails.py --file leads.txt --output exposure.csv --sleep 2This tool is intended for authorized security testing and education only. Use it exclusively against systems you own or have explicit written permission to assess. The author assumes no liability for misuse or for any damage caused by this software. You are responsible for complying with all applicable laws.
MIT © 2025-2026 Caio Henrique (CHDevSec)
Part of the CHDevSec security tooling — portfolio · LinkedIn