leak.fun
—

Guides

Search Operators

Every field in the breach search has a CONT menu that controls how its value is matched. These are the knobs — match type, wildcards, case sensitivity and fuzzy matching.

Match types

The match type decides where your text has to land inside the stored value. contains is the default and the most forgiving.

contains

Matches if the value contains your text anywhere. Default. doe matches john.doe@mail.com.

exact

Matches only the whole value, character for character. john matches john but not johnny.

startsWith

Matches when the value begins with your text. jo matches john and joanna.

endsWith

Matches when the value ends with your text. @gmail.com matches every Gmail address.

regex

Full regular-expression matching for surgical queries. Powerful, but slower — reach for it last.

Wildcards

Turn on wildcard mode for a field and two characters become operators:

*

Matches zero or more characters.

?

Matches exactly one character.

So, on a username field with wildcards enabled:

jord*92      →  jordan_skywalker92, jord92, jordxx92
j?rdan       →  jordan, jurdan (one character in the gap)
*@proton.me  →  every ProtonMail address
Wildcards and regex are mutually exclusive ways of saying the same thing — pick whichever reads more clearly for the query you have in mind.

Case sensitivity

Searches are case-insensitive by default — JOHN and john are treated the same. Flip case sensitive on when the casing genuinely matters, for example when matching a base64 token or a case-significant hash.

Fuzzy matching

On text fields — names, addresses, free-text — you can enable fuzzy matching. It tolerates a few typos and spelling variants, so jonathon still finds jonathan. Fuzziness is automatic, scaled to the length of your term.

Fuzzy matching only applies to text fields. On exact-value fields (emails, IBANs, IDs, hashes) it's ignored — there's no "close enough" for an account number.

Combining fields

Every field you fill is combined with AND. A first name plus a city plus a birth year is three constraints the record must satisfy at once — the fastest way to cut a thousand Johns down to the one you mean.

  • Phone numbers take a country prefix (e.g. +33) that's normalised onto the number before matching.
  • Birth year is a shortcut field — give just a year and it matches any birthdate within it.

Facets

After a search, the facet panel tallies values from the results you already have — cities, countries, source files. Toggling a facet narrows the visible list without firing another request, so exploring is instant and free.