Breach indexes join an email address to incidents that have become public enough to catalogue. The match tells you where to look first. It does not reveal whether the password in that incident was unique, whether it has since been changed, or whether an attacker ever used the data.
Start with password reuse. Change the affected credential anywhere it was repeated, then protect the email account that receives resets. Multi-factor authentication and a password manager reduce the chance that one old dataset turns into access across several services. The password strength checker can explain weaknesses locally without sending the password away.
Why the privacy notice is unusually direct
A domain-only request cannot answer whether one address is indexed. The full address therefore reaches XposedOrNot through our Worker. The browser-to-Worker request keeps it in a POST body, but XposedOrNot's API requires the encoded address in its upstream URL path, where the provider's request logging policy applies. We do not cache the response and normalize the answer down to incident names. If that disclosure is not acceptable, do not submit the address.
This search is separate from the email reputation checker, which reviews syntax and public domain evidence without performing a breach lookup. Use the email validator when the question is deliverability rather than exposure.