01 · Product name
DeHashed
Breach search, monitoring, an API, and WHOIS from one vendor.
Published by DeHashed.
In short
DeHashed is a breach-data search site. Its pages describe search across compromised records for usernames, emails, IP addresses, names, hashes, and related fields, plus monitoring, an API, and WHOIS lookups. Monitoring is advertised as free. Search is presented as a subscription, but the public price figures were not a stable number when this listing was reviewed. A row in a breach file is a lead about exposure. It is not a password to reuse.
Product pricing strategy
02
Free and paid
DeHashed is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
Monitoring is advertised as free. Search is presented as a subscription. When this listing was reviewed, the public package prices were not a reliable dollar figure. Check dehashed.com.
Utility and features
03
DeHashed collects records that have already been exposed and lets a user search them. The homepage describes that collection as data posted on the clear web and the deep web, searchable by username, email address, IP address, and more. The search page adds names, hashes, addresses, phone numbers, VIN numbers, and a domain scan to the field list. A query can take more than one parameter so the result set narrows. That is the product investigators mean by the name: a search box over a breach corpus, not a notice that says only “this address appeared in this named breach.”
- Search. One box over breach records. Fields the site names include username, email, IP, name, address, phone, VIN, hash, and domain. Combine parameters to narrow.
- Monitoring. Advertised as a free watch on emails, phones, usernames, domains, and similar selectors, with alerts by email, text, or webhook.
- API and WHOIS. A search API for your own tools, and a WHOIS product with history and reverse lookup. The site says the API expects a search subscription.
- Price. Not safe to quote from here. On review, package amounts on the site were N/A or zero while the marketing page implied a paid comparison. Check the live page.
Have I Been Pwned answers the narrower question and is the right first stop when all you need is the breach name. Intelligence X is the other archive in this directory, with published annual prices and a separate Identity Portal. DeHashed’s pitch is size and a bundle of adjacent lookups. The site also sells, or describes, a monitoring service, a search API, a WHOIS product with current and historical records and reverse WHOIS, and a realtime feed. Monitoring is advertised as free: emails, phones, usernames, domains, and similar selectors, with alerts and no credit card. Government users and nonprofits are told they can ask support about free access. Those sentences are the company’s. They are not a promise this directory can verify from outside the login.
Pricing is the part to read carefully. When this listing was reviewed, the search packages on dehashed.com were labeled Enthusiast, a monthly term, and an annual term, and the amounts on the page rendered as “N/A”. API credit packs and WHOIS credit packs rendered as $0. The homepage at the same time compared the company with competitors using a “starts at” figure that does not match those package pages. Do not quote a DeHashed price from Osint Daily. Open the live pricing controls and, if you are buying, get the number in the checkout or from support.
What you do with a hit is the constraint. A breach row can contain a password or a hash. Reusing a stolen password, or trying it against a live account, is not OSINT and it is not what this page is for. The lawful uses are the defensive ones and the investigative ones you are actually authorized to run: see whether an address you own, or a selector in a case you are allowed to work, is sitting in this corpus; reset the credential; record the breach name, the date, and the field types. Do not paste the secret into a report, a ticket, or a chat. The API is for teams who need that check inside their own system, and the site says a search subscription is required before the API will run. Confirm that gate when you look at the current account page.
DeHashed is freemium in this directory because the company advertises a free monitoring tier beside a paid search product. If the search box you need is behind the subscription, budget for the subscription and treat the free tier as alerts, not as the archive.
- 1
Start with Have I Been Pwned if you only need to know whether an email is in a named breach.
- 2
If you need the DeHashed corpus, read the current search price in the product before you rely on a figure from anywhere else.
- 3
Search a selector you are allowed to investigate. Record the breach, the date, and which fields came back.
- 4
Do not reuse a password or a hash from a result. Reset credentials you control and leave the secret out of the report.
Caveats
04
DeHashed is a breach-search product with a free tier and paid access, including an API. A row is a record from a corpus, often old, sometimes duplicated, sometimes a different person who reused a username.
It does not tell you the password still works, and this listing will not tell you to try it. Compare with Have I Been Pwned before you describe the exposure to anyone. Monitor alerts follow whatever selectors you entered. Do not monitor a person you are not allowed to monitor.
Screenshots
05
Potential use cases
06
- You are responsible for an email, username, or domain and you want to know if this breach corpus has it. Search DeHashed. The output is rows from that corpus, which you then compare with Have I Been Pwned and, if you use it, Intelligence X. A hit is an exposure in this dataset, not proof of a current password and not a credential to try. This page does not describe credential reuse.
- The site advertises a free monitor. Put it on selectors you are allowed to watch, and treat an alert as a prompt to open the row and the breach, not as an incident by itself. Pivot the same selector to HIBP to see whether the notification corpora agree. They often will not. Write both results and the dates.
- An internal tool should run an authorized lookup through the API once the subscription allows it. The output is those fields in your system, with DeHashed named as the source. Do not scrape the website to avoid the API. The WHOIS and monitoring pages are separate features. Confirm what your plan includes on dehashed.com.
Hard cases
The case where the first result is easy to over-read.
The row has a password and someone wants it tested
Stop at the fact of the row: this corpus contains this selector, in this breach, as of the date you looked. Testing the password against a live service is not a lookup. Hand the owner the breach name so they can rotate credentials at the real provider. If you need a second corpus, search Have I Been Pwned or Intelligence X. Do not copy the password into a note that other people can read.
Questions
Is DeHashed free?
Monitoring is advertised as free. Search is presented as a subscription. When this listing was reviewed, the public package prices were not a reliable dollar figure. Check dehashed.com.
Can I use a password DeHashed shows me?
No. A breach record is evidence of exposure. Reusing the secret against an account is not a use of this directory, and it is not a defensive check.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
DeHashed home
https://dehashed.com/Product
DeHashed search
https://dehashed.com/searchDocumentation
DeHashed search API
https://dehashed.com/apiPricing
DeHashed monitoring
https://dehashed.com/monitoringDocumentation
DeHashed WHOIS
https://dehashed.com/whois