Exposure-Check-OSINT — Is your email, username or password leaked? Self-hosted, 18 keyless sources

The product, not mockups

Every screenshot below is captured from a real running install — live sources, live verdicts, real exposure.

Exposure Check dashboard — one input, five identifier types, live corpus stats

The dashboard. Paste any identifier — the type is auto-detected and the corpus stats are computed from the actual local indexes.

Live results — exposure score gauge, CRITICAL EXPOSURE verdict, source cards

Live results. Parallel fan-out to every supporting source; every card carries severity, evidence and an honest three-state verdict.

Printable exposure report — masked identifier, 0/100 score, per-source table

The report. Self-contained, generated locally, identifier masked by design — one click to PDF.

Five checks, one box

Personal identifiers, not domain scanning — that's the scanner CE's job. This tool answers one question: what do attackers already know about you?

📧

Email

Breach collections, stealer-log infections, disposable flags, public-code associations

👤

Username

Which of 150 platforms carry this name — logo grid, Bluesky, Hacker News, GitHub

📱

Phone

Validity, country, line type, COMB leak association

🔑

Password

HIBP Pwned Passwords with k-anonymity — only a 5-char hash prefix ever leaves your browser

🌐

IP

Open ports (Shodan InternetDB), VPN / proxy / hosting classification

The 18 sources — all keyless

No API keys to buy, no accounts to create, no rate-limit roulette. If a source is down it says so — it never fakes a "clear".

Hudson Rock stealer logsSTEALER

COMB credential datasetBREACH

XposedOrNot breach analyticsBREACH

HIBP Pwned PasswordsK-ANON

Maigret — 150 sitesPROFILE

WhatsMyName DBPROFILE

GitHub public activityPROFILE

Gravatar profile & photoPROFILE

Bluesky account existencePROFILE

Hacker News accountsPROFILE

Disposable email detectionREPUTATION

Disify email intelligenceREPUTATION

libphonenumber validationPHONE

Shodan InternetDBINFRA

IP reputation & classificationINFRA

+3 more in the attribution PDFDOCS

● EXPOSED

Evidence found — the source returns real matches, masked in the UI and stripped of credential material before storage.

● CLEAR

The source answered and found nothing. A real answer, not a guess.

● UNAVAILABLE

The source is down or blocked. It never counts as "clear" — honesty over cosmetics.

Run it in one command

Docker pulls a single container (Apache + PHP 8.3 + SQLite). Nothing else. Your data stays on your disk.

# 1. clone & launch — http://localhost:8090
git clone https://github.com/RanaKhan77/Exposure-Check-OSINT.git
cd Exposure-Check-OSINT && docker compose -f docker/docker-compose.yml up -d

# 2. sign in (password set on first boot) and check yourself
# 3. that's it — no keys, no accounts, no telemetry

🔐

Privacy by design

Identifiers stored as salted hashes + masked forms only. Password checks store nothing — matching happens in your browser.

🧠

Zero AI, on purpose

Every verdict is a deterministic, reproducible HTTP lookup. No model, no bill, no hallucinated findings.

🧾

Honest scoring

Exposure score 0–100 (100 = clean). Dead sources degrade honestly and never fake a pass.

📄

Full docs set

Overview, install, privacy design, source attribution and FAQ — as PDFs on the releases page.