Overview
LeakCheck positions itself as a data-breach search engine for individuals and companies worried about credential exposure. Operating since 2018, the platform indexes billions of records and offers email, username, keyword, domain, and even reverse password lookups. Users can run queries through a web interface, API, or Telegram bot, with tiered plans ranging from a $2.99 daily pass to a $69.99 lifetime option. An Enterprise tier starting at $179 per quarter adds bulk checking, dedicated support, and integration assistance for corporate environments.
The service distinguishes itself in the no-KYC tool space by accepting Monero, Bitcoin, and Lightning Network payments alongside fiat and cash options. It also maintains a Tor onion mirror and publishes open-source components, features that signal awareness of its privacy-focused user base. However, the platform's operational security and data-handling practices paint a more complicated picture than its marketing suggests.
Privacy & KYC
LeakCheck sits at KYC Tier L2, Discreet, meaning minimal identity verification is required: typically just an email address. Social login options (including Telegram authentication) are available, which reduces friction but potentially links activity to persistent identities. The platform does not demand government ID or extensive personal documentation, making it accessible to users seeking anonymous breach monitoring.
The critical concern is logging. LeakCheck logs IP addresses, a significant liability for a service handling sensitive breach data. Combined with email-based accounts, this creates a linkable trail between queries and real-world identity. The privacy score of 5/100 reflects this fundamental tension: a tool marketed for digital identity protection actively undermines user anonymity through aggressive telemetry. The trust score of 0/100 further amplifies alarm, suggesting either severe operational opacity, unresolved security incidents, or problematic data-sourcing practices that have damaged institutional confidence.
- Minimal KYC: email-only signup with social login alternatives
- IP logging enabled, no option for query isolation
- Tor available but efficacy degraded if post-login behavior is tracked
- Open-source components offer partial transparency, not full auditability
Supported assets & payments
LeakCheck accepts an unusually broad payment spectrum for its category: Monero (XMR), Bitcoin (BTC), Lightning Network, fiat currencies, and cash. This flexibility supports users who prioritize financial privacy, particularly Monero users seeking unlinkable transactions. The inclusion of Lightning suggests attention to Bitcoin's scalability and fee concerns, though on-chain Bitcoin remains less private than XMR for this use case.
Pricing tiers are straightforward but not cheap for casual use. The $2.99 daily Basic Plan offers 15 email lookups, sufficient for spot-checking a personal footprint. The $9.99 Monthly Plan expands to 200 daily email/username searches plus 15 keyword queries. The $69.99 Lifetime Plan doubles those limits and represents the best value for ongoing monitoring. Enterprise pricing scales from $179 quarterly with unrestricted lookups and API access. All paid tiers include developer API credentials, enabling integration into external workflows or corporate security stacks.
Security & custody
As a non-custodial information tool, LeakCheck does not hold user funds or cryptographic keys, users pay for access, not deposit assets. This eliminates exchange-style custody risks but introduces different concerns: the service stores query histories and account data, and its breach database itself contains massive quantities of stolen credentials that represent attractive targets for attackers.
Technical infrastructure shows mixed signals. The primary domain (leakcheck.io) uses valid HTTPS with Google Trust Services certificates, and Scam Detector assigns it a relatively high 86.9/100 safety rating. Yet the trust metrics from our directory's own assessment diverge sharply, indicating possible gaps between surface-level security hygiene and deeper operational integrity. The presence of stealer log data in results, confirmed by user reports, raises ethical questions about whether LeakCheck sources from malware distributions rather than strictly public breach dumps. The open-source claim offers some accountability, but without comprehensive repository audits, it functions more as marketing than verified assurance.
Who it's for, verdict
LeakCheck serves a narrow niche: privacy-aware individuals and security teams willing to trade some anonymity for breach visibility. Journalists, incident responders, and corporate defenders may find value in its API and bulk-checking capabilities, provided they access it through Tor with compartmentalized accounts. The Monero payment option and minimal KYC lower barriers for users in restrictive jurisdictions or those avoiding financial surveillance.
However, the IP logging, rock-bottom privacy score, and zero trust rating make it unsuitable for users requiring robust operational security. The contradiction at LeakCheck's core, selling identity protection while actively logging identifiers, undermines its value proposition for the no-KYC community. With an overall score of 6/10, it functions as a pragmatic, if imperfect, breach intelligence source rather than a trustworthy privacy partner. Users should treat queries as potentially linkable, rotate access credentials frequently, and prefer Monero over traceable payment methods. For those with lower risk tolerance, alternatives like Have I Been Pwned offer more transparent, less invasive checking, albeit with fewer features and no cryptocurrency payments.
