DeHashed
Credential and breach intelligence from the DeHashed dataset.
DeHashed searches breach records for emails, usernames, phones, domains, names, and IPs — returning credential rows with database provenance, leak dates, and related identity fields. Its public list, as of 22 September 2026, has 24,051 data wells and 24,507,853,884 pieces of data.
Capabilities
- Field-scoped search across email, username, phone, domain, name, and IP
- Return breach records with database name and leak metadata
- Surface plaintext and hashed passwords when present in source data
- Public corpus of 24,051 data wells and 24,507,853,884 pieces of data (as of 22 September 2026)
- Show total hits and remaining API balance from upstream metadata
Data
DeHashed’s public data wells list, checked 22 September 2026, has 24,051 named sources and 24,507,853,884 pieces of data. Each well on that list has a name, a date, and a record count. DeHashed’s site says 4.0 records are still being indexed, so a well on the list may not be in search results yet. A SearchIn hit is grouped by the well it came from. Password and hash fields stay masked until you reveal them. A row is historical breach data.
What you get back
- Records grouped by breach database
- Masked password fields with reveal toggle
- Filter across databases and record fields
- Upstream total and balance metadata
UI workflow
Choose Email, Username, Phone, Domain, Name, or IP.
Select DeHashed.
Review grouped breach records and expand sensitive fields as needed.
Sample queries
| Input type | Query | Notes |
|---|---|---|
email | alex.rivera@example.com | Credential exposure check |
domain | example.com | Domain-wide breach footprint |
ip | 203.0.113.45 | IP-linked breach records |
Pricing
email $0.30 · username $0.30 · phone $0.30 · domain $0.30 · name $0.30 · ip $0.30
Best for
- Credential stuffing and account takeover assessments
- Domain and employee exposure reviews
- Complementing LeakRadar and LeakOSINTbot breach views
How it works & why through OSINTverse
How the request runs
- 1Choose email, username, phone, domain, name, or IP and select DeHashed.
- 2SearchIn maps your input type onto the matching DeHashed search field and issues the query.
- 3Matching breach records return with database provenance, leak metadata, and identity fields.
- 4SearchIn groups records by database, masks password and hash fields behind a reveal toggle, and keeps totals from upstream.
Coverage. As of 22 September 2026, DeHashed’s public list has 24,051 data wells and 24,507,853,884 pieces of data. Each well is a named source with a date and a record count.
Why route DeHashed through OSINTverse
- ·Pay $0.30 when you actually search instead of carrying a subscription between cases.
- ·Password and hash fields are masked by default with a reveal toggle — safer for screen shares and shared team workspaces.
- ·Run DeHashed, Snusbase, and LeakRadar on the same identifier in one batch to see where the datasets disagree.
| DeHashed directly | Through OSINTverse | |
|---|---|---|
| Getting started | DeHashed sells its own paid subscription with an API key bound to a single account. | Sign in, top up from $10, and run DeHashed the same minute — no vendor contract, seat, or sales call. |
| What a query costs | Plan, credit pack, or contract pricing set by the vendor and paid up front. | Pay per query from your prepaid balance — DeHashed starts at $0.30 for email lookups, with the exact price shown before you run it. |
| Failed lookups | Handled under the vendor's own credit and refund policy. | Automatically refunded to your wallet — a search that fails upstream after billing is not charged. |
| Output format | A vendor-specific response shape you normalise and render yourself. | Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration. |
| Cross-source work | Copy-paste between vendor dashboards to follow a lead into another dataset. | Results join one case graph, so you can pivot an entity into any of the other 16 integrations in a click. |
| Running it for a team | Per-seat or per-account access, billed and administered per analyst. | One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee. |
| Volume work | Script the vendor API yourself, including retries, polling, and rate handling. | Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling. |
One wallet, no subscriptions
Top up prepaid USD from $10 and spend it a query at a time across all 17 integrations. No monthly fee, no seat count — and the balance never expires.
Failed searches are refunded
If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.
One API for every source
The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.
Cases and pivot graph
Results land in a named case you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.
Team wallets and controls
Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.
Exports built in
Download any result as JSON, CSV, or PDF, and export the case graph as PNG, SVG, entities CSV, or graph JSON.
Good to know
- A returned password or hash comes from a historical breach. It does not confirm the credential still works.
- DeHashed’s site says 4.0 records are still being indexed, so a well on the public list may not be in search results yet. Figures on this page are from 22 September 2026.
- The published total counts pieces of data, not unique people.
- Name and IP searches are broader than email or username, so expect more noise to filter.
API example
$0.30 per query. The Example tab is free sample data. The Try it tab runs a real search and charges the active workspace wallet at the same rates as the dashboard.
Records
3
12 total upstream
Databases
3
Distinct breach sources
Upstream
145ms
4,990 credits left
curl -X POST "https://apiv1.osintverse.com/v1/search" \ -H "Content-Type: application/json" \ -H "x-api-key: ov_your_api_key" \ -d '{"provider":"dehashed","input_type":"email","query":"alex.rivera@example.com"}'Invalid provider + input_type pairs return HTTP 422. Confirm combinations with GET /v1/providers or the pricing matrix.
Run this in the SearchIn UI or create an API key. Full HTTP reference: search workflow. Marketing overview: DeHashed integration.