leaker

README

leaker

Passive leak enumeration tool.

Features • Usage • Install • Configuration

Created by Maksim Radaev/@vflame6

---

leaker is a leak discovery tool that returns valid credential leaks using passive online sources. It supports searching by email, username, domain, keyword, and phone number.

Features

• 12 sources — aggregates results from multiple leak databases
• 5 search types — email, username, domain, keyword, phone
• Deduplication — removes duplicate results across sources
• JSONL output — structured output for pipelines (-j)
• Rate limiting — built-in per-source rate limits (disable with -N)
• Proxy support — route traffic through HTTP proxy (--proxy)
• Multiple API keys — load balancing across keys per source

Available sources

Source	API Key	Search Types	Pricing
BreachDirectory	Yes	all (auto-detect)	Free via RapidAPI
DeHashed	Yes	email, username, domain, keyword, phone	Paid
Hudson Rock	No*	email, username, domain	Free / Paid
Intelligence X	Yes	all	Free tier available
LeakCheck	Yes	email, username, domain, keyword, phone	Paid
Leak-Lookup	Yes	email, username, domain, keyword, phone	Paid
LeakSight	Yes	email, username, domain, keyword, phone	Paid
OSINTLeak	Yes	email, username, domain, keyword, phone	Paid
ProxyNova	No	all	Free
Snusbase	Yes	email, username, domain, keyword, phone	Paid
WeLeakInfo	Yes	email, username, domain, keyword, phone	Paid
WhiteIntel	Yes	email, username, domain	Paid

Usage

leaker -h

Usage: leaker <command> [flags]

  leaker is a leak discovery tool that returns valid credential leaks for emails, using passive online sources.

Flags:
  -h, --help                                     Show context-sensitive help.
  -s, --sources=all,...                          Specific sources to use for enumeration (default all). 
                                                 Use --list-sources to display all available sources.
  --timeout=30s                                  Seconds to wait before timing out (default 30s)
  -N, --no-rate-limit                            Disable rate limiting (DANGER)
  -j, --json                                     Output results as JSONL (one JSON object per line)
  --no-deduplication                             Disable deduplication of results across sources
  --no-filter                                    Disable results filtering, include every result
  -o, --output=STRING                            File to write output to
  --overwrite                                    Force overwrite of existing output file
  -V, --verify                                   Verify credentials using HIBP password check and hash identification
  -p, --provider-config="provider-config.yml"    Provider config file
  --proxy=STRING                                 HTTP proxy to use with leaker
  -A, --user-agent=STRING                        Custom user agent
  --insecure                                     Disable TLS certificate verification (use with caution)
  --version                                      Print version of leaker
  -q, --quiet                                    Suppress output, print results only
  -v, --verbose                                  Show sources in results output
  -D, --debug                                    Enable debug mode
  -L, --list-sources                             List all available sources

Commands:
  domain      Search by domain name.
  email       Search by email address.
  keyword     Search by keyword.
  phone       Search by phone number.
  username    Search by username.

  Run "leaker <command> --help" for more information on a command.

Examples

Search by email:

leaker email user@example.com

Search by domain using specific sources and piped input:

echo "example.com" | leaker domain -s leakcheck,dehashed

Search by phone number with JSONL output:

leaker phone 1234567890 -j -o results.jsonl

Installation

leaker requires go1.24 to install successfully.

go install -v github.com/vflame6/leaker@latest

Compiled binaries are available on the Releases page.

Build from source:

go build -o leaker main.go

Build with Docker:

docker build -t leaker .

Configuration

leaker generates a provider-config.yml file on first launch. Add your API keys there:

breachdirectory: [RAPIDAPI_KEY]
dehashed: [DEHASHED_API_KEY]
hudsonrock: [CAVALIER_API_KEY]
intelx: [INTELX_API_URL:INTELX_API_KEY]
leakcheck: [LEAKCHECK_API_KEY]
leaklookup: [LEAKLOOKUP_API_KEY]
leaksight: [LEAKSIGHT_TOKEN]
osintleak: [OSINTLEAK_API_KEY]
snusbase: [SNUSBASE_ACTIVATION_CODE]
weleakinfo: [WELEAKINFO_PUBLIC_KEY:WELEAKINFO_PRIVATE_KEY]
whiteintel: [WHITEINTEL_API_KEY]

Each source accepts a list of API keys for load balancing:

leakcheck: [key1, key2, key3]

Intelligence X uses HOST:API_KEY format to support different tiers:

intelx: [free.intelx.io:your-uuid]   # free tier
intelx: [2.intelx.io:your-uuid]      # paid tier

Contributing

Feel free to open an issue if something does not work, or if you have any ideas to improve the tool.