# DeHashed

Credential and breach intelligence from the DeHashed dataset.

URL: https://osintverse.com/docs/providers/dehashed

DeHashed searches breach records for emails, usernames, phones, domains, names, and IPs — returning credential rows with database provenance, leak dates, and related identity fields. Its public list, as of 22 September 2026, has 24,051 data wells and 24,507,853,884 pieces of data.

## Capabilities

* Field-scoped search across email, username, phone, domain, name, and IP
* Return breach records with database name and leak metadata
* Surface plaintext and hashed passwords when present in source data
* Public corpus of 24,051 data wells and 24,507,853,884 pieces of data (as of 22 September 2026)
* Show total hits and remaining API balance from upstream metadata

## Data

DeHashed’s [public data wells](https://dehashed.com/data-wells) list, checked 22 September 2026, has **24,051** named sources and **24,507,853,884** pieces of data. Each well on that list has a name, a date, and a record count. DeHashed’s site says 4.0 records are still being indexed, so a well on the list may not be in search results yet. A SearchIn hit is grouped by the well it came from. Password and hash fields stay masked until you reveal them. A row is historical breach data.

## What you get back

* Records grouped by breach database
* Masked password fields with reveal toggle
* Filter across databases and record fields
* Upstream total and balance metadata

## UI workflow

Choose Email, Username, Phone, Domain, Name, or IP.

Select DeHashed.

Review grouped breach records and expand sensitive fields as needed.

## Sample queries

| Input type | Query                     | Notes                        |
| ---------- | ------------------------- | ---------------------------- |
| `email`    | `alex.rivera@example.com` | Credential exposure check    |
| `domain`   | `example.com`             | Domain-wide breach footprint |
| `ip`       | `203.0.113.45`            | IP-linked breach records     |

## Pricing

`email` **$0.30** · `username` **$0.30** · `phone` **$0.30** · `domain` **$0.30** · `name` **$0.30** · `ip` **$0.30**

## Best for

* Credential stuffing and account takeover assessments
* Domain and employee exposure reviews
* Complementing LeakRadar and LeakOSINTbot breach views

## How it works & why through OSINTverse

### How the request runs

1. Choose email, username, phone, domain, name, or IP and select DeHashed.
2. SearchIn maps your input type onto the matching DeHashed search field and issues the query.
3. Matching breach records return with database provenance, leak metadata, and identity fields.
4. SearchIn groups records by database, masks password and hash fields behind a reveal toggle, and keeps totals from upstream.

**Coverage.** As of 22 September 2026, DeHashed’s public list has 24,051 data wells and 24,507,853,884 pieces of data. Each well is a named source with a date and a record count.

### Why route DeHashed through OSINTverse

- Pay $0.30 when you actually search instead of carrying a subscription between cases.
- Password and hash fields are masked by default with a reveal toggle — safer for screen shares and shared team workspaces.
- Run DeHashed, Snusbase, and LeakRadar on the same identifier in one batch to see where the datasets disagree.

|  | DeHashed directly | Through OSINTverse |
| --- | --- | --- |
| Getting started | DeHashed sells its own paid subscription with an API key bound to a single account. | Sign in, top up from $10, and run DeHashed the same minute — no vendor contract, seat, or sales call. |
| What a query costs | Plan, credit pack, or contract pricing set by the vendor and paid up front. | Pay per query from your prepaid balance — DeHashed starts at $0.30 for email lookups, with the exact price shown before you run it. |
| Failed lookups | Handled under the vendor's own credit and refund policy. | Automatically refunded to your wallet — a search that fails upstream after billing is not charged. |
| Output format | A vendor-specific response shape you normalise and render yourself. | Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration. |
| Cross-source work | Copy-paste between vendor dashboards to follow a lead into another dataset. | Results join one case graph, so you can pivot an entity into any of the other 16 integrations in a click. |
| Running it for a team | Per-seat or per-account access, billed and administered per analyst. | One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee. |
| Volume work | Script the vendor API yourself, including retries, polling, and rate handling. | Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling. |

- **One wallet, no subscriptions.** Top up prepaid USD from $10 and spend it a query at a time across all 17 integrations. No monthly fee, no seat count — and the balance never expires.
- **Failed searches are refunded.** If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.
- **One API for every source.** The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.
- **Cases and pivot graph.** Results land in a named case you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.
- **Team wallets and controls.** Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.
- **Exports built in.** Download any result as JSON, CSV, or PDF, and export the case graph as PNG, SVG, entities CSV, or graph JSON.

### Good to know

- A returned password or hash comes from a historical breach. It does not confirm the credential still works.
- DeHashed’s site says 4.0 records are still being indexed, so a well on the public list may not be in search results yet. Figures on this page are from 22 September 2026.
- The published total counts pieces of data, not unique people.
- Name and IP searches are broader than email or username, so expect more noise to filter.

## API example

Try `dehashed` free with mock data in the API sandbox: https://osintverse.com/developers/sandbox

> Invalid `provider` + `input_type` pairs return HTTP 422. Confirm combinations with [GET /v1/providers](https://osintverse.com/docs/api/overview) or the [pricing matrix](https://osintverse.com/docs/pricing).

Run this in the [SearchIn UI](https://osintverse.com/searchin/search) or create an [API key](https://osintverse.com/dashboard/api). Full HTTP reference: [search workflow](https://osintverse.com/docs/api/search). Marketing overview: [DeHashed integration](https://osintverse.com/integrations/dehashed).