Does h8mail need API keys?

For live service lookups, yes. Supply a config file with -c holding keys for HaveIBeenPwned, Snusbase, Dehashed, hunter.io, and others. Without keys you can still search local breach files offline.

Can it search breaches offline?

Yes. Point it at the BreachCompilation torrent folder with -bc, a local cleartext file with -lb, or a gzip dump with -gz. Offline lookups keep sensitive queries inside your environment.

What does chase mode do?

Chase (-ch) pulls related emails from hunter.io into the ongoing target list. --power-chase expands that to all configured services. It grows an OSINT sweep from a single starting address.

Can I query username, IP, or domain instead of email?

Yes. -q runs a custom query by username, password, ip, hash, or domain. Add --loose to disable email pattern matching for broader local hits.

Updated Jul 14, 2026

Social Engineering

Map leaked credentials for target emails

Email OSINT against breach services and local dumps.

Find where an email was breached Search local breach dumps offline Expand a target list with chase

overview

What h8mail does

h8mail takes a target email or file via -t and returns breach hits tied to leaked credentials. Online mode needs a -c config of API keys. Offline mode searches -lb cleartext dumps or a -bc BreachCompilation folder.

Reach for it when OSINT needs to know where an address was exposed. Without keys or local dumps, the run returns little. Chase (-ch) pulls related emails from hunter.io back into the target list.

Trickest runs h8mail as a managed Social Engineering node that emits a file and folder of hits. Pair with theharvester or sherlock when you need people and account recon beyond breach data.

source github.com/khast3x/h8mail

use cases

Where h8mail fits

Find where an email was breached

Query configured breach services for a target address to surface leaked credentials and the breaches that exposed them.

Search local breach dumps offline

Point h8mail at the BreachCompilation folder or your own cleartext and gzip dumps so sensitive lookups run entirely in your environment.

Expand a target list with chase

Use chase to pull related emails from hunter.io and other services into the ongoing target list, widening an OSINT sweep from one address.

Run a custom recon query

Query by username, password, ip, hash, or domain with -q so a single run covers more than email-to-breach lookups.

reference

h8mail inputs and flags

17 inputs

Name	Type	Flag	Description
target-input	STRING	-t	Target string input, such as an email address.
target-file-input	FILE	-t	File of targets to check in one run.
config-file	FILE	-c	Config file of API keys (Snusbase, Dehashed, HaveIBeenPwned, hunter.io, and more).
local-breach	FILE	-lb	Local cleartext breach file to scan for targets.
breachcomp	FOLDER	-bc	Path to the BreachCompilation torrent folder for offline search.
user-query	STRING	-q	Custom query by username, password, ip, hash, or domain.
chase	STRING	-ch	Add related emails from hunter.io to the target list, per-target count.
hide-passwords	BOOLEAN	--hide	Show only the first four characters of found passwords.

Showing key inputs. h8mail exposes 17 inputs in total.

Full flag reference (17 inputs)

Name	Type	Flag	Description
keys	STRING	-k	Pass config options inline. Supported format: K=V,K=V
chase	STRING	-ch	Add related emails from hunter.io to the ongoing target list; sets how many emails per target to chase. Needs a hunter.io key unless used with power-chase.
debug	BOOLEAN	--debug	Print request debug information.
gzip-src	FILE	-gz	Local tar.gz (gzip) compressed breach to scan for targets.
url-input	STRING	-u	URL string input (requires http:// or https://).
breachcomp	FOLDER	-bc	Path to the BreachCompilation torrent folder; uses the bundled query.sh script.
user-query	STRING	-q	Run a custom query by username, password, ip, hash, or domain; searches loosely when run locally.
config-file	FILE	-c	Config file of API keys: Snusbase, WeLeakInfo, Leak-Lookup, HaveIBeenPwned, Emailrep, Dehashed, and hunter.io.
power-chase	BOOLEAN	--power-chase	Add related emails from all API services to the target list; use with chase.
single-file	BOOLEAN	-sf	For big cleartext or tar.gz breaches, show a progress bar; disables concurrent file search for stability.
local-breach	FILE	-lb	Local cleartext breach file to scan for targets.
loose-search	BOOLEAN	--loose	Allow loose search by disabling email pattern recognition.
target-input	STRING	-t	Target string input, such as an email address.
skip-defaults	BOOLEAN	-sk	Skip the HaveIBeenPwned and hunter.io checks.
hide-passwords	BOOLEAN	--hide	Show only the first four characters of found passwords.
url-file-input	FILE	-u	File of URLs to use as input.
target-file-input	FILE	-t	File of targets to check in one run.

example

Run h8mail

h8mail · command

# scan a list of emails against configured breach services, mask passwordsh8mail -t targets.txt -c config.ini --hide -o exposure.json

sample output

h8mail 2.5.6 >> alice@example.com    ├── hibp - compromised in: LinkedIn, Dropbox, Canva    ├── emailrep - reputation: none, blacklisted: false    └── hunter.io (public) - related emails found: 4>> bob@example.com    ├── hibp - compromised in: Adobe    └── local file - line: bob@example.com:Su5f****[+] Found 6 results, writing to exposure.json

guidance

Choosing h8mail

Use when you have a known email and need breach exposure, online via -c API keys or offline via -lb/-bc. Needs configured services or dumps to return useful hits. For broader people and account OSINT, prefer theharvester or sherlock.

theharvester

Gathers emails, hosts, and names from public sources. h8mail stays on breach data for a known address.

leakos

Searches for leaked secrets and credentials. Sibling angle on exposed-credential hunting.

pwndb

Looks up leaked credentials for an account. Overlaps h8mail breach lookups.

faq

h8mail questions

Yes, when a source returns them. Services like Snusbase and Dehashed, and local cleartext dumps, can include plaintext or hashed passwords next to a hit. Add --hide to mask all but the first four characters.

sherlock
Username checks across social networks with optional CSV export.

Run h8mail yourself

A list of target emails feeds h8mail, which checks breach and recon services and writes the exposure hits as a queryable output.

Run h8mail in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target-input

STRING

-t

Target string input, such as an email address.

target-file-input

FILE

-t

File of targets to check in one run.

config-file

FILE

-c

Config file of API keys (Snusbase, Dehashed, HaveIBeenPwned, hunter.io, and more).

local-breach

FILE

-lb

Local cleartext breach file to scan for targets.

breachcomp

FOLDER

-bc

Path to the BreachCompilation torrent folder for offline search.

user-query

STRING

-q

Custom query by username, password, ip, hash, or domain.

chase

STRING

-ch

Add related emails from hunter.io to the target list, per-target count.

hide-passwords

BOOLEAN

--hide

Show only the first four characters of found passwords.

Name

Type

Flag

Description

keys

STRING

-k

Pass config options inline. Supported format: K=V,K=V

chase

STRING

-ch

Add related emails from hunter.io to the ongoing target list; sets how many emails per target to chase. Needs a hunter.io key unless used with power-chase.

debug

BOOLEAN

--debug

Print request debug information.

gzip-src

FILE

-gz

Local tar.gz (gzip) compressed breach to scan for targets.

url-input

STRING

-u

URL string input (requires http:// or https://).

breachcomp

FOLDER

-bc

Path to the BreachCompilation torrent folder; uses the bundled query.sh script.

user-query

STRING

-q

Run a custom query by username, password, ip, hash, or domain; searches loosely when run locally.

config-file

FILE

-c

Config file of API keys: Snusbase, WeLeakInfo, Leak-Lookup, HaveIBeenPwned, Emailrep, Dehashed, and hunter.io.

power-chase

BOOLEAN

--power-chase

Add related emails from all API services to the target list; use with chase.

single-file

BOOLEAN

-sf

For big cleartext or tar.gz breaches, show a progress bar; disables concurrent file search for stability.

local-breach

FILE

-lb

Local cleartext breach file to scan for targets.

loose-search

BOOLEAN

--loose

Allow loose search by disabling email pattern recognition.

target-input

STRING

-t

Target string input, such as an email address.

skip-defaults

BOOLEAN

-sk

Skip the HaveIBeenPwned and hunter.io checks.

hide-passwords

BOOLEAN

--hide

Show only the first four characters of found passwords.

url-file-input

FILE

-u

File of URLs to use as input.

target-file-input

FILE

-t

File of targets to check in one run.

h8mail 2.5.6 >> alice@example.com ├── hibp - compromised in: LinkedIn, Dropbox, Canva ├── emailrep - reputation: none, blacklisted: false └── hunter.io (public) - related emails found: 4>> bob@example.com ├── hibp - compromised in: Adobe └── local file - line: bob@example.com:Su5f****[+] Found 6 results, writing to exposure.json

Map leaked credentials for target emails

What h8mail does

Where h8mail fits

Find where an email was breached

Search local breach dumps offline

Expand a target list with chase

Run a custom recon query

h8mail inputs and flags

Run h8mail

Choosing h8mail

theharvester

leakos

pwndb

h8mail questions

More Social Engineering tools

sherlock

Run h8mail yourself

Map leaked credentials for target emails

What h8mail does

Where h8mail fits

Find where an email was breached

Search local breach dumps offline

Expand a target list with chase

Run a custom recon query

h8mail inputs and flags

Run h8mail

Choosing h8mail

theharvester

leakos

pwndb

h8mail questions

More Social Engineering tools

sherlock

Run h8mail yourself