Breach Exposure Guide

Say what was exposed and get an ordered plan — what to change today, what to watch for, and what not to do.

Runs on your deviceSecurity & PrivacyWorkingNo account needed

What this tool does

Breach Exposure Guide is a reference tool driven by your answers, not a search. It asks how you found out — a notice from the company, an alert from a monitoring service or password manager, suspicious activity on the account, or nothing more than a suspicion — and which categories of data were involved: password or password hash, email address, phone number, home address and date of birth, payment card or bank details, government ID number. Two further boxes cover the things that decide how far the damage spreads: whether that password was reused elsewhere, and whether two-factor authentication was already switched on.

From those answers it assembles a plan in four ordered sections — Do now, Within a few days, Keep watching for the next 6–12 months, and Do not — because the ordering is what people get wrong under pressure. A leaked password, payment card or ID number, or activity you did not recognise, flags the whole plan as Act today; anything else is reported as low-to-moderate exposure. Ticking reuse promotes rotating that password everywhere to an immediate step, since leaked credentials are replayed across other sites within hours — though reuse and the two-factor box only reshape those sections when the password category is ticked as well. Ticking email pulls securing the mailbox to the front, on the grounds that it is the reset path for every other account you hold.

The optional input box above the settings takes account names, one per line, and adds a per-account table to the plan: change the password, enable two-factor, sign out other sessions, check recovery settings. Two crude string matches refine those rows. A line containing mail, gmail, outlook, proton, yahoo or icloud is marked to be done first; a line containing bank, card, pay, finance or one of a short list of bank and wallet names gains a step about reviewing transactions. It is substring matching on what you typed, so a bank whose name is not in that list — or an entry written as a nickname — gets the generic four steps, while an unrelated line that happens to contain pay or card collects a transaction step it does not need.

The limit worth stating plainly is that this tool knows nothing about you or about any breach. No breach corpus is queried, no email address is checked against a leak, and nothing here can confirm that anything actually happened — that has to come from the notice you received or from a reputable breach-notification service you visit yourself. The advice is general rather than jurisdictional: the credit-freeze step names the three United States bureaus, while reporting routes, regulators and card-dispute deadlines differ by country, so treat the output as a checklist to adapt rather than legal or financial instruction. Everything is assembled inside this browser tab, so the account names you list never travel, and disconnecting the machine before you start changes nothing about the plan you get.

How to use it

  1. Say how you found out. Four options: a breach notice, a monitoring or password-manager alert, suspicious activity, or just checking. Each adds its own follow-up step, and suspicious activity is treated as a live account takeover.
  2. Tick what was exposed. Password and email address are ticked by default. Add phone, address and date of birth, payment card or government ID number as the notice describes them. Each category contributes its own steps, but not to every section — a payment card adds one immediate step and one watch item, while an address on its own adds only a watch item.
  3. Say whether the password was reused, and whether 2FA was on. Reuse turns a single password change into a sweep across everywhere that password was used. Two-factor already being on swaps the immediate switch-it-on step for a few-day review of trusted devices and app passwords; it does not make the password change itself any less urgent.
  4. List the affected accounts, if you want the table. One per line, in the optional input; lines starting with # are ignored. Leave it empty and you still get the full plan, just without the per-account breakdown.
  5. Work the sections in order. Do now first, then the few-day items, then keep the watch list for the next 6–12 months. The Do-not list is short and worth reading before you act on anything that arrives by email or phone.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

A breach notice has landed in your inbox

Notices tend to be vague about what to do next. Ticking the fields the notice names turns it into specific steps, and adds one of its own: reread the notice for whether the passwords were hashed, and take any free monitoring on offer without paying for more.

Your password manager flags a stored login

The alert tells you which site and roughly when. The plan covers the case where the account is old or already deleted — the password itself is still the liability if you used it anywhere else.

Unfamiliar logins or password-reset emails appear

This is treated as a takeover rather than a leak: change the password, end every other session, and inspect recovery addresses and forwarding rules for changes someone else made.

Talking someone else through it

The plan comes out as three numbered sections and a short do-not list, which is easier to read down a phone line than a security article. The per-account table gives them something to tick off as they go.

Deciding what actually needs doing

Not every leak is an emergency. With only an email address and a home address ticked, the plan says so, and puts phishing awareness on the watch list instead of sending you to freeze your credit.

Questions

Does it check whether my email address appears in a breach?
No. There is no lookup of any kind — no breach corpus, no password hash search, no account check. The plan is built only from the boxes you tick, and the output says so on its first line. To find out whether you were in a known breach, search a reputable breach-notification service directly, then come back and record what it listed.
Do the account names I type leave this page?
No. The settings and the optional account list are read and turned into the plan inside this browser tab, nothing is transmitted or stored, and the tool behaves identically offline. Account names are often revealing on their own, which is the reason it is built this way.
What makes it say Act today rather than low-to-moderate?
A ticked password, payment card or government ID number, or choosing suspicious activity as the source. Those are the categories where the window between a leak and its use is measured in hours or days. Everything else produces a plan with the same structure but no urgency flag.
Is this legal, financial or security advice for my situation?
No. It is a general checklist assembled from common post-breach guidance, and it cannot see your circumstances. The credit-bureau step names the United States agencies specifically; elsewhere the equivalent is a different body with different rules, and a serious identity-theft case needs the reporting route your own country provides.
Why does it tell me to change the password on other sites too?
Because a leaked password is tried against other services automatically. Attackers take the credentials from one breach and replay them across banks, mail providers and shops at scale, which is why reuse turns a single-site incident into a general one. Password Generator produces unique replacements, and Password Strength Checker rates what you have chosen.
It listed a step I have already done. Can I remove it?
Not from inside the tool — the plan is regenerated from the settings each time rather than tracked as a to-do list. Untick a category and the steps belonging to it disappear; anything already finished you will have to track elsewhere, because the tool keeps no record between runs.
Does the per-account table know anything about the sites I list?
No. It matches your text against a short list of words for mail providers and for banks and wallets, and adjusts the steps when one is found. Nothing is looked up, no site is contacted, and a service it does not recognise still gets the four standard steps.

Related tools

  • Protect PDF — Add a password and set permissions on a PDF.
  • Sign PDF — Draw, type or upload a signature and place it on the page.
  • Hash Generator — Compute MD5, SHA-1, SHA-256 and SHA-512 digests.
  • Password Generator — Generate strong passwords with rules you control.
  • Redact PDF — Permanently remove sensitive content, not just cover it.
  • Remove PDF Metadata — Strip identifying metadata before you share a file.