Leakcheck

LeakCheck

Query LeakCheck for whether an identifier appears in known breaches and info-stealer logs.

Public API returns where it leaked and which field categories were exposed — never the values. Pro API v2 returns full rows (names, usernames, passwords, phones, etc.) and remaining quota.

Route

1. Read LEAKCHECK_API_KEY. If unset, also accept the official alias LEAKCHECK_APIKEY.
2. Key present → Pro API v2.
3. Key absent → Public API. If the query needs a Pro-only type (phone, domain, keyword, password, origin, phash), stop and say Pro is required instead of calling Public.

Keep the key in the X-API-Key header. Query-string ?key= ends up in logs; skip it. Never print, commit, or echo the key.

Canonical caller: skills/leakcheck/scripts/lookup.sh <query> [type].

Public API (free)

GET https://leakcheck.io/api/public?check={check}

No auth. Type is auto-detected. URL-encode {check}. Minimum 3 characters.

Accepted inputs:

curl --request GET \
  --url "https://leakcheck.io/api/public?check=$(printf %s "$CHECK" | jq -sRr @uri)" \
  --header "Accept: application/json"

200 example:

{
  "success": true,
  "found": 3,
  "fields": ["username", "first_name", "address"],
  "sources": [
    { "name": "Evony.com", "date": "2016-07" },
    { "name": "I-Dressup.com", "date": "2016-08" },
    { "name": "Zynga.com", "date": "2019-09" }
  ]
}

• found — matching breach count
• fields — categories exposed across those breaches, not the values
• sources[].date — YYYY-MM

Rate limit: 1 request/second. Space bulk checks. Commercial/public-facing use needs a "Powered by LeakCheck" credit (terms).

Pro API v2 (paid)

GET https://leakcheck.io/api/v2/query/{query}?limit=100

curl --request GET \
  --url "https://leakcheck.io/api/v2/query/$(printf %s "$QUERY" | jq -sRr @uri)?limit=100" \
  --header "Accept: application/json" \
  --header "X-API-Key: $LEAKCHECK_API_KEY"

{query} is path-encoded, min. 3 characters. Default limit is 100 (max 1000). offset max 2500.

Optional ?type= — omit it when auto-detect works (email, username, phone, hash). Set it when auto-detect cannot (domain, keyword, origin, password) or after a 422.

Found:

{
  "success": true,
  "found": 1,
  "quota": 400,
  "result": [
    {
      "email": "example@example.com",
      "source": {
        "name": "BreachedWebsite.net",
        "breach_date": "2019-07",
        "unverified": 0,
        "passwordless": 0,
        "compilation": 0
      },
      "first_name": "Example",
      "last_name": "Example",
      "username": "leakcheck",
      "fields": ["first_name", "last_name", "username"]
    }
  ]
}

Nothing found: "found": 0, "result": []. Still a success.

Row notes:

• source.unverified / passwordless / compilation are 0/1 flags
• Stealer-log rows may have collected (YYYY-MM-DD or "April 2024 or earlier") instead of breach_date
• Extra keys vary: username, password, first_name, last_name, dob, address, zip, phone, name

Rate limit: 3 requests/second (raiseable in account settings). quota is remaining queries — surface it.

To avoid sending a raw email, SHA-256 the lower-cased address and query with type=hash.

Errors

JSON body plus HTTP status. Surface both; do not retry blindly.

On 429, wait and retry once. On 422, retry once with an explicit type. On 403, stop — plan or quota, not a transient blip.

Report

Do not paraphrase away fields. Quote API data. Mark inferred claims.

# LeakCheck: {query}
- Mode: public | pro
- Found: {n}
- Quota: {n}   (pro only)

## Exposed field categories
- …

## Sources
| Name | Date |
| --- | --- |
| … | YYYY-MM |

## Records
(pro only — one block per result row)

If Public found > 0, say that values are withheld and Pro is needed for full rows.

Treat passwords, hashes, phones, and addresses as sensitive. Put them in the report the user asked for; do not write them into logs, tickets, or world-readable files. Do not attempt logins with leaked credentials.

Docs: https://docs.leakcheck.io/overview