You checked your email address. You found the breaches. You closed the tab.
Sound familiar?
That has been the XposedOrNot experience for years. You get your answer in seconds, and then… nothing. The next breach lands three months later, and you have to remember to come back and check again. Your alerts live in one place. Your domain monitoring lives in another. Your privacy settings? Somewhere else entirely.
You deserved better. Now you have it.
Why We Built It
XposedOrNot has always been good at answering one question fast: has this email been exposed? Type it in, get your answer, done.
But protection is not a one-time event. Breaches keep happening. We added 105 breaches in 2026 alone, 21 of them in just the last 30 days. A clean result today says nothing about next Tuesday.
The missing piece was a home. One place to see your exposure, understand your risk, manage your alerts, and come back to whenever the news mentions another breach.
That’s why we built My Dashboard.
What Is My Dashboard?
My Dashboard is your personal breach command center. One sign-in, one screen: every breach you appear in, your risk score with a plain-language explanation, your active alerts, and your privacy controls.
It’s free. Completely free. No trial, no card, no premium tier hiding the good parts. The same promise as every other XposedOrNot feature: everyone deserves to protect their accounts, regardless of budget.
Getting In
One requirement: My Dashboard is available for email addresses that have breach alerts enabled, or for anyone who has verified a domain for monitoring.
Not set up yet? It takes about ten seconds. Search your email on xposedornot.com, click Alert Me, and confirm from your inbox. That’s it: you now have breach alerts and dashboard access. Domain owners, verify once by email or a DNS TXT record and you’re in too.
Signing in is just as simple. No new password to create, no new password to leak:
- Go to xposedornot.com/login
- Enter your email address
- Click the link that lands in your inbox
Three practical notes. If the link doesn’t show up in a minute, check your spam folder; it comes from notifications@xposedornot.com. You stay signed in on that device for 12 hours, and when the session expires, your protection does not: alerts keep firing whether you’re signed in or not; the dashboard is just the view. And yes, it works on your phone.
Your Breaches and Your Risk Score
Sign in and everything is on one screen.
My Breaches lists every breach your email appears in, what data was exposed in each one, and the date we added it to the database. No more re-running the search to remember what hit you.
Your risk score sits front and center, on a clear four-tier scale from Low to Critical. Right below it is the part we care about most: a “How is this calculated?” expander that shows exactly what drives your number, in plain language. Which breaches, which data types, how recent.
One honest note: the score reflects breaches that have already happened, and history doesn’t un-happen. What you control is your exposure from here forward, and the breakdown shows you exactly where to act. No black-box scores. No confusing jargon. A number you can actually do something about.
Alerts show what breach alerts you have active, manageable in one click. And Privacy Shield is a single toggle showing your live Shield status: switch it on and your email address stops appearing in public search results on XposedOrNot. Your data, your call.
Exposed? Do This Today
Seeing your address in breach after breach is an awful feeling. Here’s what actually helps, starting today.
First, check your list for AlienStealerLogs. If it’s there, read the next section before you touch a single password; the order matters.
For everything else:
- Change the passwords on the breached accounts. Start with your email and anything touching money. Make each one unique; a password manager does the remembering for you.
- Turn on two-factor authentication on those same accounts. A leaked password matters far less when it isn’t enough to get in.
- Close accounts you no longer use. Every dead account is exposure with zero benefit.
Stealer Logs Included. Yes, in the Free Version.
A stealer, short for infostealer, is malware with one job: silently copy the passwords, cookies, and autofill data saved on an infected device. Last month we added AlienStealerLogs to the database: 299 million unique email addresses harvested by exactly that kind of malware.
This matters because a stealer-log hit is different from a website breach. It usually means a device you used was infected. So the order of operations changes: scan your devices with reputable antivirus first, and only then change your passwords, from a device you trust. Rotating passwords on an infected machine just hands the new ones to the attacker.
If your address is in there, My Dashboard shows it alongside your other breaches, with the same detail. Other major breach-notification services put stealer-log visibility behind paid plans running hundreds of dollars per month. We think knowing that malware stole your credentials is not a luxury feature. It’s in your search, your dashboard, and your alerts. Free.
Want the full story? Read our stealer logs announcement.
Fresh Data, You Can Verify
A dashboard is only as good as the data behind it. As of today, XposedOrNot covers 763 breaches and over 11.5 billion exposed records, all browsable in our breach directory, and the database moves fast:
- Turknet (5.3 million records), added July 4
- Mercer (320,000 records), added July 3
- Maxance (268,000 records), added July 2
- Sysco (2.7 million records), added June 30
Don’t take our word for it. Our public metrics API returns a Last_Breach_Added timestamp, so anyone can check how fresh the data is at any moment. Transparency you can query.
Is My Data Safe?
We don’t store the email addresses you search for. A search is answered and forgotten, never logged in any identifiable form.
So how can a dashboard remember your breaches? Because alerts work differently, and that’s the deal you opt into: when you click Alert Me, you’re asking us to keep exactly one thing, the address to watch. That is the entire point of an alert. Unsubscribe at any time, and it’s gone, dashboard access included. The same goes for verified domains: ask, and we remove them.
We don’t track you across the web, and we don’t sell anything to anyone. You don’t have to trust us blindly either: the entire platform is open source on GitHub, our transparency report spells out how we handle data, and the FAQ covers the fine print, including how erasure requests work.
For Teams: Domain Monitoring
Everything above works for a whole domain too.
My Domains summarizes exposure across every domain you’ve verified: breached accounts, exposure trends, the works. If you already use our CxO Dashboard, the breach-monitoring console for companies, your existing verification carries over. Sign in with the address you verified with, and your domains are waiting- no additional steps.
Just last week, a European fintech onboarded ten of their domains and now monitors all of them from this console, completely free. Verification takes minutes: add a DNS TXT record if you prefer or verify with HTML file.
The deeper tools live here too: Breach Analysis for timelines and exposure patterns, VIP monitoring for your most sensitive addresses, and phishing analysis for your domains.
Get Started Now
Enable alerts on xposedornot.com or verify your domain, then head to xposedornot.com/login and click the link in your inbox. Ten seconds later, you have a breach command center.
No payment. No catch.
And this is just the start. Two things are already on the roadmap: step-by-step remediation guidance for every breach on your list, and family monitoring, so you can watch over your loved ones’ addresses from the same dashboard. Coming soon.
Found something confusing? Have an idea? Open an issue on GitHub or reach out. This dashboard exists because the community kept asking for a home. Here it is.
For Developers: This Week Under the Hood
The dashboard pulls live data, so we spent the same week tuning the engine. Every change is public, commit by commit:
- The breach catalog is now cached in-process, hot paths batch their reads, and every worker shares its database and Redis connections.
- Public endpoints send proper cache headers and answer repeat requests with 304s.
- The rate limiter pipelines its checks and fails over to an in-memory fallback if Redis blips, so the API keeps serving instead of erroring.
- Live smoke tests run against production daily in CI.
- Our MCP server gained tools for metrics, domain summaries, and recent breaches, so AI assistants can query XposedOrNot directly.
You can also generate and manage your API key right inside My Dashboard. Same endpoints, same free tier, just faster and harder to knock over.
