StuffingGuard – Your Open-Source Tool to Check for Email or Password Leaks
What is StuffingGuard?
StuffingGuard is a free, open-source web tool that helps you check if your email address or password has been exposed in known data breaches.
When hackers compromise websites, databases, or services, they often leak or sell millions of stolen credentials online. These leaked credentials are then used in credential stuffing attacks—automated attempts to log into your other accounts using the same email and password combination.
StuffingGuard checks your credentials against databases of known breaches to tell you:
- For emails: Which data breaches (if any) have exposed your email address
- For passwords: Whether your password has appeared in any known breach databases
If your credentials have been compromised, you’ll know immediately—and can take action by changing your passwords, enabling two-factor authentication, or monitoring your accounts for suspicious activity.
Visit the app at: https://stuffingguard.vercel.app/
Architectural Decisions
Since StuffingGuard adheres to a strict privacy-first strategy, I was highly deliberate about my tech choices. I went with Next.js with TypeScript for the UI + the Have I Been Pwned API for passwords (utilizing the k-anonymity model so your password never leaves the device) and the XposedOrNot API for emails. This stack is also ideal for transparency since anyone can download the codebase, inspect it, and run it locally. No heavy installations or database setups required.
Sources
The app: https://stuffingguard.vercel.app/
GitHub: https://github.com/gitmhd/stuffingguard/blob/main/README.md
What is k-anonymity: https://www.k2view.com/blog/what-is-k-anonymity