The DeHashed free breach check is one of the most honest free tools in the breach-index category, and also one of the most misread. You type an email, username or phone into the Quick Check box on dehashed.com/search, no account needed, and it comes back with a single number: how many security incidents that identifier appears in. When I ran it on the public Gmail address of a well-known figure I use in benchmarks, the page said "Uh-oh, your data was involved in 7 security incidents" and nothing else. That number is real and it is useful, but it answers a narrower question than most people think they asked.
This post walks through what the free check returns, what the Search subscription adds at $6.99 a week, $21.99 a month or $219.99 a year, and why a historical breach corpus and a live account search are two different instruments that accept the same input. It closes with how OSINTsearch handles the same email: a free full sweep of which accounts exist today, with breach exposure added on a paid ladder.
What the DeHashed free breach check actually shows
The anonymous check renders three tiles. One is the count of incidents matching your query. The other two are platform-wide counters, which on 2026-09-05 read 24,116,034,155 total records and 24,051 data wells. Beneath them the page prints the sentence with your number in it, a timestamp, and the call to action: "Login or Register to use our full suite of tools to protect your data."
Quick Check
Breach Exposure
7
24,116,034,155
24,051
Uh-oh, your data was involved in 7 security incidents
Search Time: Sat, 05 Sep 2026 14:57:51 GMTThat is the whole free result. It does not name a breach, does not say which fields leaked, and does not show a record. The design is deliberate: return a count rather than tease partial rows. For someone asking "am I in anything, and roughly how much" it is a good answer delivered with no email capture and no signup. The minimum query is five characters, and the search type selector lists All, Email, Username, IP Address, Name, Address, Phone, VIN and Domain Scan.
DeHashed describes itself as more than a breach index: "it's not just a hacked database search engine, but also a people search (this means a lot of whitepage databases)." So the 7 incidents may include white-pages style aggregations as well as classic credential dumps. The count tells you the identifier has surfaced in seven collected datasets. It does not tell you when, what sat next to it, or whether any of those datasets still matter.
The three access levels and what they cost
The anonymous check returns the count. A registered account with no subscription can run searches but does not see record contents. The Search subscription sees the records, and on 2026-09-05 the tiers read as follows.
| DeHashed Search plan | Price | Duration | Searches |
|---|---|---|---|
| Enthusiast | $6.99 | 1 week, 7 days | Unlimited asset searches |
| Monthly (marked Popular) | $21.99 | 1 month, 30 days | Unlimited asset searches |
| Annually | $219.99 | 1 year, 365 days | Unlimited asset searches |
The API is a separate purchase: Search API credits cost $3.00 per 100 (500 for $15.00, 5,000 for $150.00, 10,000 for $300.00), and the page states that "you need a subscription to Search in order to use the API Service." Monitoring has a free Start plan with 10 tasks, a $29.99 per domain monthly tier, and a $99.99 per month enterprise tier. Government personnel and non-profits can ask support for free access, and the FAQ says every product is free for 501(c)(3) organizations, NGOs and government bodies including law enforcement.
Credit where it is due: a week of unlimited breach searches for $6.99 is unusually accessible, and the terms say there are no hidden fees or hidden subscriptions. The query language is serious, with true wildcards, regex and search operators over more than 24 billion records. The abuse engineering is thoughtful: leaky-bucket anti-scraping, account locking on suspicious volume, no logging of which records a user opened, and a self-service Remove Entry button under results. The public data-wells directory lists each breach with its record count and exposed fields, for example MGM Grand Hotels at 142,471,103 records with address, birthdate, email, full name and phone number.
Historical corpus versus live account discovery
Here is the distinction that matters once you have your number. A breach index searches a collection of records that leaked at some point in the past and were later indexed. Every hit is a row from a dataset with a date. That is the right tool for "what has been exposed" and "should I rotate this password", and DeHashed does it well.
A live account search asks a different question: which public accounts does this identifier resolve to right now. There is no corpus. Each module contacts a platform at query time and reports whether the email is registered there, what the profile URL is, and whatever the platform publishes about the account. The result reflects today, including a profile created last week and an account no breach has ever touched.
- Unit of result. Breach index: a record from a dataset. Live search: a platform and a profile.
- Time. Breach index: the date the dataset leaked or was indexed. Live search: the moment you pressed enter.
- What a count means. Seven incidents means seven datasets contain the string. Seven live hits means seven platforms confirm a registered account today.
- What it is for. Exposure and rotation versus identity resolution and corroboration.
What a live account search adds on the free plan
On OSINTsearch the same email runs through 203 email modules in one sweep, with 770 username endpoints and 24 phone modules for the other input types. Each email module answers one question silently: is this address registered on this service. Where the platform publishes more, the card carries more: display name, avatar, user id, profile URL, and the masked recovery hints a service's own account-recovery flow shows, such as a phone ending in four digits or a partially hidden recovery address. Nothing contacts the target; no reset mail or one-time code is sent.
The free plan shows all of it. Fifteen searches a week, every card, every field, no card required. OSINTsearch shows the data for free; you pay for volume, export, breach records and depth. The anonymous demo on the landing page is a masked preview for visitors without an account; a signed-in free account sees the full result.
Breach exposure sits on a ladder above that, so the historical layer is opt-in rather than bundled into every free query.
| Plan | Price | Searches per week | Live sweep | Breach exposure | Export |
|---|---|---|---|---|---|
| Free | $0 | 15 | Every field on every card | None | None |
| Starter | $20 per month | 50 | Every field | Breach names and dates | CSV and JSON |
| Pro | $49.99 per month | 500 | Every field plus deep search, depths 1 to 4 | Full breach records, 5 units per reveal | CSV and JSON |
Starter's rung is names and dates on purpose. That is enough to timestamp an identifier's history and decide whether a full record is worth a reveal, without showing other people's paired fields to anyone who has not chosen to pay for them. Pro sees the projected record. The LeakCheck vs HaveIBeenPwned post goes deeper on why record-level breach data carries more duty than a breach list, and the pricing page has the full entitlement table. Quotas reset every Monday at 00:00 UTC.
A working sequence after the count
- Take the DeHashed count as a flag, not a finding. Seven incidents means the address has a past worth a look.
- Run the address through a live sweep and sort the hits by what they carry: full profile, recovery hint, existence only.
- Pivot every display name and username from the profile hits into a username search. Bios and outbound links on those cards are where the second identifier usually appears; the Epieos alternative post shows a real sweep where one bio carried six linked accounts.
- If the case justifies it, pull breach names and dates on Starter, and reveal a record on Pro only when a paired username or phone would change the picture.
- Export the set as JSON or CSV and reconcile: do creation dates, locations and display names across live hits and breach dates agree?
FAQ
Is the DeHashed free breach check really free?
Yes. The Quick Check on dehashed.com/search needs no account and returns the number of incidents an identifier appears in, plus a timestamp. Breach names and record contents need a Search subscription, which starts at $6.99 for one week.
Does the free check tell me which breaches I am in?
No. It returns a count only. A registered but unpaid account can run searches without seeing record contents; the Search subscription shows the records.
What does a live account search show that a breach index does not?
Which platforms confirm a registered account for the identifier today, with profile URL, display name, avatar and any masked recovery hints the platform publishes. A breach index shows rows from datasets that leaked in the past.
Does OSINTsearch show breach records on the free plan?
No. Free runs the live sweep with every field shown, 15 times a week. Starter adds breach names and dates, Pro adds full breach records at 5 units per reveal. Passwords are never shown on any plan.
Two questions, one address
The DeHashed free breach check gives you an honest number for free, and its subscription is one of the cheapest ways to read the records behind it. What it cannot tell you is where that address is a live login this afternoon. That is the question a live sweep answers, with every field free, and the two together are a far better picture of an identifier than either alone.
