Stealer Check Find out if an infostealer has your logins.
Breach lists tell you what leaked. Stealer Check tells you what was taken from your device: the sites, the saved passwords, the session cookies and when. Free, and the result goes only to your inbox.
- Address
- [email protected]
- Captured
- 3 Oct 2026, Windows 11 laptop
- Malware
- Lumma Stealer
- Services
- google.com, paypal.com, steampowered.com, +14
- Password
- pa••••••23
- Session cookies
- 27 capturedA live cookie lets an attacker in without your password or 2FA.
Not a breach. A copy of your browser.
A data breach means a company you use lost a copy of its customer list, usually with hashed passwords, often years ago. Change that one password and you're done.
A stealer log is different. Infostealer malware ran on your own computer and copied everything the browser had saved: every site, every password, every signed-in session. Changing one password doesn't fix that. Cleaning the device, then signing out everywhere, does.
Have I Been Pwned is the place to check data breaches. Stealer Check looks at what malware took from an infected device, and tells you what to do about it. Use both.
What are infostealers?How it works
Three steps, and the only person who sees the result is you.
Enter your email
Any address: personal or work. This page never says whether it was found.
Read the result in your inbox
We email it to that address and nowhere else. Only someone who can open the inbox sees it.
Fix it, in order
Clean the device first, then sign out everywhere, then change passwords. The email walks you through it.
What you'll see
Sites and usernames
Every service the malware found saved in your browser, with the username it took.
Masked passwords
Only in your account, never by email: enough of each password to recognise it, not the whole thing.
Session cookies
Which signed-in sessions were copied. These are the ones to kill first.
Device and date
The machine it came from and when it was captured, so you know which computer to clean.
The emailed result lists services and dates. Device, cookie and masked-password detail comes with a free account, where the source log includes it.
If we find you, do this
The order matters. Resetting passwords on a still-infected machine just hands the attacker the new ones.
Clean the device
Run a full scan with a reputable antivirus, or back up and reinstall. Remove cracked software and game cheats: they're the usual way in.
Sign out everywhere
Google, Microsoft, Apple, Facebook, Discord, Steam and your bank all have a "sign out of all devices" option. Stolen cookies bypass passwords and 2FA, so this comes before any reset.
Change passwords, from a clean device
Email first, then every service listed, then anything that shared a password with them.
Turn on 2FA and check recovery
Prefer passkeys or an authenticator app. Check email forwarding rules, recovery addresses and connected apps for anything you didn't add.
Was it a work device?
If the infected machine had work logins on it, your employer's accounts are exposed too. Tell your IT team, or check your whole company's domain for free. It takes one work email and emails back an exposure report.
Keep watching
New stealer logs appear every day. Once you've confirmed your address, you can keep it monitored for free and we'll email you if it turns up in a new log. Remove it, or delete everything, whenever you like.
Stealer Check: common questions
What people ask before they check.
Can I check someone else's email address?
No. Results only ever go to the address itself, by email. Typing in someone else's address tells you nothing and sends them a confirmation link. If you're worried about a friend or family member, send them this page.
If nothing is found, am I safe?
A clean result means we haven't seen your address in the stealer logs we hold. It doesn't mean it has never been taken. Keep monitoring on, and if your device behaves oddly, follow the infection guide anyway.
Why do you email the result instead of showing it?
Because a stealer log is far more sensitive than a breach record: it shows which sites you use and your usernames. Sending it to the address itself means only someone who can open that inbox ever sees it.
How is this different from Have I Been Pwned?
Have I Been Pwned is the best place to check data breaches, and it shows results on the page. Stealer Check is about infostealer logs: what malware copied from your own device, including saved passwords and session cookies. Because that detail is private, we verify you first and show the fix steps alongside it.
Will you show me my passwords?
Not by email, ever. With a free account you can see each password masked, enough to recognise which one was taken so you know what to change.
What do you store about me?
The address you asked us to check, for 30 days, or for as long as you keep it monitored. You can remove an address or delete everything yourself at any time. The stolen data itself was collected from criminal sources and is held to detect and respond to compromise, as set out in our privacy policy.
Check your own email. Free.
Takes a minute. The result goes to your inbox and nowhere else.