# Snusbase

Breach and stealer-log search across Snusbase leak tables.

URL: https://osintverse.com/docs/providers/snusbase

Snusbase searches leaked databases for emails, usernames, names, domains, and IPs — returning credential rows grouped by dump, with hashes, hosts, and related identity fields when present. Its public statistics, checked 22 September 2026, list 18,523,442,591 rows in 2,251 tables.

## Capabilities

* Field-scoped search across email, username, name, domain, and IP
* Return records grouped by Snusbase table / dump name
* Surface plaintext passwords, hashes, hosts, and last-seen IPs
* Public index of 18,523,442,591 rows across 2,251 tables (checked 22 September 2026)
* Map SearchIn domain and IP queries to Snusbase `_domain` and `lastip` types

## Data

Snusbase’s [public database statistics](https://docs.snusbase.com/#database-statistics), checked 22 September 2026, list **18,523,442,591** rows in **2,251** tables. The row count is rows, not unique people. Snusbase puts a category in each table name. The largest groups by number of tables — not by number of rows — are gaming (341), social (215), hacking (193), store (119), tech (115), and Minecraft (95), out of 186 categories.

Email and domain columns appear on 2,018 tables. A hash column appears on 1,547 tables. A plaintext password column appears on 391. SearchIn queries email, username, name, domain, and IP.

## What you get back

* Records grouped by leak table
* Masked password and hash fields with reveal toggle
* Filter across dumps and record fields
* Upstream hit count and latency metadata

## UI workflow

Choose Email, Username, Domain, Name, or IP.

Select Snusbase.

Review grouped leak records and expand sensitive fields as needed.

## Sample queries

| Input type | Query                     | Notes                            |
| ---------- | ------------------------- | -------------------------------- |
| `email`    | `alex.rivera@example.com` | Credential exposure check        |
| `domain`   | `example.com`             | Domain-wide leak footprint       |
| `ip`       | `203.0.113.45`            | IP-linked stealer / leak records |

## Pricing

`email` **$0.30** · `username` **$0.30** · `domain` **$0.30** · `name` **$0.30** · `ip` **$0.30**

## Best for

* Credential stuffing and account takeover assessments
* Stealer-log and combo-dump investigations
* Complementing DeHashed and LeakRadar breach views

## How it works & why through OSINTverse

### How the request runs

1. Choose email, username, domain, name, or IP and select Snusbase.
2. SearchIn translates the input — including domain to `_domain` and IP to `lastip` — into Snusbase search types for you.
3. Matching rows return grouped by leak table, with passwords, hashes, hosts, and last-seen IPs where present.
4. SearchIn masks sensitive fields by default and records upstream hit counts and query latency.

**Coverage.** As of 22 September 2026, Snusbase’s public statistics list 18,523,442,591 rows in 2,251 tables. Table names include a category. The largest groups by table count are gaming, social, hacking, store, tech, and Minecraft.

### Why route Snusbase through OSINTverse

- SearchIn handles the Snusbase search-type mapping, so a plain domain or IP query just works.
- Stealer-log and combo-dump rows are grouped by table with secrets masked until you choose to reveal them.
- Pairs directly with DeHashed in one bulk run for overlap and corroboration checks.

|  | Snusbase directly | Through OSINTverse |
| --- | --- | --- |
| Getting started | Snusbase requires its own account and paid plan, with an API key issued from their dashboard. | Sign in, top up from $10, and run Snusbase the same minute — no vendor contract, seat, or sales call. |
| What a query costs | Plan, credit pack, or contract pricing set by the vendor and paid up front. | Pay per query from your prepaid balance — Snusbase starts at $0.30 for email lookups, with the exact price shown before you run it. |
| Failed lookups | Handled under the vendor's own credit and refund policy. | Automatically refunded to your wallet — a search that fails upstream after billing is not charged. |
| Output format | A vendor-specific response shape you normalise and render yourself. | Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration. |
| Cross-source work | Copy-paste between vendor dashboards to follow a lead into another dataset. | Results join one case graph, so you can pivot an entity into any of the other 16 integrations in a click. |
| Running it for a team | Per-seat or per-account access, billed and administered per analyst. | One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee. |
| Volume work | Script the vendor API yourself, including retries, polling, and rate handling. | Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling. |

- **One wallet, no subscriptions.** Top up prepaid USD from $10 and spend it a query at a time across all 17 integrations. No monthly fee, no seat count — and the balance never expires.
- **Failed searches are refunded.** If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.
- **One API for every source.** The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.
- **Cases and pivot graph.** Results land in a named case you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.
- **Team wallets and controls.** Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.
- **Exports built in.** Download any result as JSON, CSV, or PDF, and export the case graph as PNG, SVG, entities CSV, or graph JSON.

### Good to know

- A password or hash on a row is historical dump data. It does not confirm the credential still works.
- Category cards count tables, not rows. Email and domain columns are on 2,018 tables, hashes on 1,547, and plaintext passwords on 391. Figures are from 22 September 2026.
- Snusbase also accepts password and hash as search types. SearchIn queries email, username, name, domain, and IP.
- Host and last-seen IP fields are leads from the dump, not proof of a current address.

## API example

Try `snusbase` free with mock data in the API sandbox: https://osintverse.com/developers/sandbox

> Invalid `provider` + `input_type` pairs return HTTP 422. Confirm combinations with [GET /v1/providers](https://osintverse.com/docs/api/overview) or the [pricing matrix](https://osintverse.com/docs/pricing).

Run this in the [SearchIn UI](https://osintverse.com/searchin/search) or create an [API key](https://osintverse.com/dashboard/api). Full HTTP reference: [search workflow](https://osintverse.com/docs/api/search). Marketing overview: [Snusbase integration](https://osintverse.com/integrations/snusbase).