These bots check whether your email or phone number has appeared in a known data breach, searching public leak databases so you can react — change a password, enable two-factor authentication — before someone else uses that data against you.
The Telegram bot of LeakCheck.io, a commercial breach-data search company operating since 2018 — check your own email or phone for free against their database. Its parent company also sells broader paid lookups, so treat the free bot strictly as a self-check tool.
Send your own email address and it tells you whether that address has surfaced in a known data breach — a simple, unofficial Telegram front-end for the "have I been pwned" checking model. Never enter your actual password into it.
| # | Bot | Price | Languages | Inline | Groups | Score |
|---|---|---|---|---|---|---|
| 1 | LeakCheck @LeakCheck1_Bot | Freemium | EN | no | no | 63 |
| 2 | Have I been pwned? @pwned_robot | Free | EN | no | no | 59 |
We checked an email and a phone number known to be in public breach datasets against each bot, and separately tried entering a real password to see whether the bot accepted it directly (a red flag) or only ever asked for an email/phone to check against breach records. We also looked at whether the bot named its data sources and whether it claimed to log or delete the query afterward.
A legitimate breach-check bot only ever needs an email address or phone number to search against known leak databases — it should never ask you to type your actual password into the chat. Reputable checkers (the model here is services like Have I Been Pwned) either check a hashed version of the password locally or don't ask for a password at all; a bot requesting your real password 'to check if it leaked' is itself a security risk, full stop.
Check what the bot does after the query: does it claim to store your email/phone for future alerts (reasonable, if disclosed), or is it silent about data retention entirely? If your data does show up as breached, the practical next step is always the same regardless of which bot told you — change the password on that account and anywhere you reused it, and enable two-factor authentication where available. The bot is a warning system, not a fix.
A basic single-address check is free on nearly every leak-check bot. Paid tiers usually add continuous monitoring (an alert if your email appears in a new breach later) and checking multiple addresses/phone numbers at once. For a one-time check before signing up somewhere important, free is enough; if you manage several accounts or a small team's addresses, ongoing paid monitoring catches new leaks you wouldn't think to check manually.
Yes, a single-address check is free on nearly every leak-check bot; ongoing monitoring for new breaches and checking multiple addresses is usually the paid part.
No — never type your actual password into any bot. A legitimate checker only needs your email or phone number and checks it against known breach databases without you disclosing your password.
Checking just an email address is a reasonable minimum — it's already public-facing in most contexts — but avoid bots that ask for extra data like your full name, address, or password on top of that, since none of it is needed for a breach lookup.