Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 13, 2026

Social Engineering

Map leaked credentials for target emails

h8mail is an open-source email OSINT and breach-hunting tool that checks a target email against online breach and reconnaissance services or local credential dumps to find where the address was exposed and surface leaked passwords.

installpip3 install h8mail

Python

Agent
Find where an email was breachedSearch local breach dumps offlineExpand a target list with chase

overview

What h8mail does

h8mail takes a target email or file via -t and returns breach hits tied to leaked credentials. Online mode needs a -c config of API keys. Offline mode searches -lb cleartext dumps or a -bc BreachCompilation folder.

Reach for it when OSINT needs to know where an address was exposed. Without keys or local dumps, the run returns little. Chase (-ch) pulls related emails from hunter.io back into the target list.

Trickest runs h8mail as a managed Social Engineering node that emits a file and folder of hits. Pair with theharvester or sherlock when you need people and account recon beyond breach data.

source github.com/khast3x/h8mail

use cases

Where h8mail fits

Find where an email was breached

Query configured breach services for a target address to surface leaked credentials and the breaches that exposed them.

Search local breach dumps offline

Point h8mail at the BreachCompilation folder or your own cleartext and gzip dumps so sensitive lookups run entirely in your environment.

Expand a target list with chase

Use chase to pull related emails from hunter.io and other services into the ongoing target list, widening an OSINT sweep from one address.

Run a custom recon query

Query by username, password, ip, hash, or domain with -q so a single run covers more than email-to-breach lookups.

reference

h8mail inputs and flags

17 inputs
NameTypeFlagDescription
target-inputSTRING-tTarget string input, such as an email address.
target-file-inputFILE-tFile of targets to check in one run.
config-fileFILE-cConfig file of API keys (Snusbase, Dehashed, HaveIBeenPwned, hunter.io, and more).
local-breachFILE-lbLocal cleartext breach file to scan for targets.
breachcompFOLDER-bcPath to the BreachCompilation torrent folder for offline search.
user-querySTRING-qCustom query by username, password, ip, hash, or domain.
chaseSTRING-chAdd related emails from hunter.io to the target list, per-target count.
hide-passwordsBOOLEAN--hideShow only the first four characters of found passwords.

Showing key inputs. h8mail exposes 17 inputs in total.

Full flag reference (17 inputs)
NameTypeFlagDescription
keysSTRING-kPass config options inline. Supported format: K=V,K=V
chaseSTRING-chAdd related emails from hunter.io to the ongoing target list; sets how many emails per target to chase. Needs a hunter.io key unless used with power-chase.
debugBOOLEAN--debugPrint request debug information.
gzip-srcFILE-gzLocal tar.gz (gzip) compressed breach to scan for targets.
url-inputSTRING-uURL string input (requires http:// or https://).
breachcompFOLDER-bcPath to the BreachCompilation torrent folder; uses the bundled query.sh script.
user-querySTRING-qRun a custom query by username, password, ip, hash, or domain; searches loosely when run locally.
config-fileFILE-cConfig file of API keys: Snusbase, WeLeakInfo, Leak-Lookup, HaveIBeenPwned, Emailrep, Dehashed, and hunter.io.
power-chaseBOOLEAN--power-chaseAdd related emails from all API services to the target list; use with chase.
single-fileBOOLEAN-sfFor big cleartext or tar.gz breaches, show a progress bar; disables concurrent file search for stability.
local-breachFILE-lbLocal cleartext breach file to scan for targets.
loose-searchBOOLEAN--looseAllow loose search by disabling email pattern recognition.
target-inputSTRING-tTarget string input, such as an email address.
skip-defaultsBOOLEAN-skSkip the HaveIBeenPwned and hunter.io checks.
hide-passwordsBOOLEAN--hideShow only the first four characters of found passwords.
url-file-inputFILE-uFile of URLs to use as input.
target-file-inputFILE-tFile of targets to check in one run.

example

Run h8mail

h8mail · command
# scan a list of emails against configured breach services, mask passwords
h8mail -t targets.txt -c config.ini --hide -o exposure.json
sample output
h8mail 2.5.6

>> alice@example.com
    ├── hibp - compromised in: LinkedIn, Dropbox, Canva
    ├── emailrep - reputation: none, blacklisted: false
    └── hunter.io (public) - related emails found: 4
>> bob@example.com
    ├── hibp - compromised in: Adobe
    └── local file - line: bob@example.com:Su5f****
[+] Found 6 results, writing to exposure.json

guidance

Choosing h8mail

Use when you have a known email and need breach exposure, online via -c API keys or offline via -lb/-bc. Needs configured services or dumps to return useful hits. For broader people and account OSINT, prefer theharvester or sherlock.

theharvester

Gathers emails, hosts, and names from public sources. h8mail stays on breach data for a known address.

leakos

Searches for leaked secrets and credentials. Sibling angle on exposed-credential hunting.

pwndb

Looks up leaked credentials for an account. Overlaps h8mail breach lookups.

faq

h8mail questions

Yes, when a source returns them. Services like Snusbase and Dehashed, and local cleartext dumps, can include plaintext or hashed passwords next to a hit. Add --hide to mask all but the first four characters.

For live service lookups, yes. Supply a config file with -c holding keys for HaveIBeenPwned, Snusbase, Dehashed, hunter.io, and others. Without keys you can still search local breach files offline.

Yes. Point it at the BreachCompilation torrent folder with -bc, a local cleartext file with -lb, or a gzip dump with -gz. Offline lookups keep sensitive queries inside your environment.

Chase (-ch) pulls related emails from hunter.io into the ongoing target list. --power-chase expands that to all configured services. It grows an OSINT sweep from a single starting address.

Yes. -q runs a custom query by username, password, ip, hash, or domain. Add --loose to disable email pattern matching for broader local hits.

Install it with pip3 install h8mail, then run h8mail -g once to generate a h8mail_config.ini template and paste in API keys for HaveIBeenPwned, Snusbase, Dehashed, hunter.io and the rest. Query one address with h8mail -t target@example.com, or a list with h8mail -t targets.txt -c h8mail_config.ini -o results.csv to write hits to a CSV. Offline, point -lb at a local cleartext dump, -gz at a gzip dump, or -bc at a BreachCompilation folder. On the Trickest node, Target(s) feeds -t, the config path feeds -c, and breach files feed -lb and -bc; add --hide to mask found passwords.

Yes. h8mail is packaged for Kali, so you can install it with apt install h8mail, and it is also available everywhere else through pip3 install h8mail.

related

More Social Engineering tools

  1. sherlock

    Username checks across social networks with optional CSV export.

Run h8mail yourself

A list of target emails feeds h8mail, which checks breach and recon services and writes the exposure hits as a queryable output.

Open h8mail in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.