h8mail: The Essential OSINT Tool for Breach Hunting

Every 39 seconds, a hacker attack occurs somewhere on the web. In 2023 alone, over 2.6 billion records were compromised in data breaches, creating a massive underground economy of stolen credentials. For security professionals, threat hunters, and penetration testers, the challenge isn't finding breach data—it's efficiently sifting through terabytes of leaked information to identify compromised accounts before they're exploited. Enter h8mail, a revolutionary Python-based OSINT utility that transforms email investigation from a tedious manual process into an automated, intelligence-gathering powerhouse.

This comprehensive guide dives deep into h8mail's capabilities, revealing how to harness its full potential for password breach hunting. You'll discover installation methods, real-world usage patterns, advanced techniques for chasing related emails, and practical code examples extracted directly from the project's documentation. Whether you're responding to a security incident or proactively hunting for organizational threats, h8mail delivers the reconnaissance firepower modern defenders demand.

What is h8mail?

h8mail is an open-source email OSINT (Open Source Intelligence) and password breach hunting tool created by security researcher khast3x. Written in Python 3, it provides a unified command-line interface for querying multiple breach databases simultaneously—both local and remote—to determine if email addresses have been compromised and what credentials may have been exposed.

Unlike single-purpose breach checkers, h8mail functions as a comprehensive reconnaissance platform. It integrates with over ten different services, ranging from free public APIs like HaveIBeenPwned to premium intelligence platforms such as Dehashed, Snusbase, and IntelX. The tool's architecture emphasizes flexibility and performance, utilizing Python's multiprocessing capabilities to scan massive local breach compilations while maintaining elegant API integrations for real-time queries.

The cybersecurity community has embraced h8mail because it solves a critical pain point: centralized email intelligence gathering. Rather than manually checking multiple services or writing custom scripts for each API, security teams can execute a single command that aggregates results across all configured data sources. This efficiency has made h8mail a staple in penetration testing distributions and incident response toolkits, with thousands of downloads weekly and active development that continuously adds new data sources and features.

At its core, h8mail bridges the gap between publicly available breach information and professional-grade investigation tools. It respects rate limits, handles API authentication seamlessly, and outputs structured data that integrates with larger security workflows—all while remaining accessible enough for security researchers just beginning their OSINT journey.

Key Features That Make h8mail Powerful

Intelligent Email Pattern Matching

h8mail employs sophisticated regular expression patterns to identify email addresses from any input source. This regex engine isn't limited to simple address validation—it intelligently extracts emails from unstructured text, tool outputs, and web pages. The pattern recognition supports common obfuscation techniques, catching addresses that less capable tools might miss. This feature proves invaluable when processing logs, chat transcripts, or data dumps where email formats vary wildly.

Direct URL Parsing and Email Extraction

Security researchers often need to extract email addresses from live web pages. h8mail's URL processing capability uses the -u flag to fetch remote content and automatically parse discovered email addresses. This eliminates the manual step of using separate scraping tools, creating a streamlined workflow for reconnaissance against target domains. The tool respects HTTP/HTTPS protocols and can process multiple URLs in a single command.

Flexible Loose Pattern Searching

Traditional OSINT tools require exact email formats, but h8mail's --loose flag revolutionizes this limitation. When enabled, it searches for partial matches using space-separated patterns like "john.smith" or "evilcorp" across breach data. This capability uncovers associated accounts, alternative email formats, and username variations that strict matching would miss—critical for building comprehensive target profiles during investigations.

Bulk Processing at Scale

The -t flag accepts both individual email addresses and file paths containing thousands of targets. h8mail's file-reading engine uses memory-efficient generators, preventing system overload when processing massive target lists. Combined with filepath globbing support, investigators can feed entire directories of target files, making enterprise-scale assessments practical and fast.

Multi-Format Structured Output

Results export to both CSV and JSON formats through the -o and -j flags respectively. The CSV output provides spreadsheet-friendly data for management reporting, while JSON delivers machine-readable structures perfect for integration with SIEM platforms, custom analytics scripts, or threat intelligence pipelines. This dual-format approach ensures h8mail fits seamlessly into any security stack.

Local Breach Compilation Support

For offline investigations or compliance-sensitive environments, h8mail scans local breach databases using multiprocessing. The -lb flag targets cleartext files while -gz handles compressed .tar.gz archives. This local-first approach maintains investigation privacy and dramatically reduces query times compared to API-only tools. The tool automatically detects file types and optimizes search strategies accordingly.

Premium API Integration Ecosystem

h8mail's configuration system supports API keys for nine major intelligence services. The -c flag loads configuration files containing credentials for HaveIBeenPwned, Hunter.io, Snusbase, Leak-Lookup, Emailrep.io, Dehashed, IntelX, and others. This modular design lets investigators pay only for the services they need while maintaining a single, consistent query interface across all platforms.

Related Email Chasing

Perhaps h8mail's most innovative feature is email chasing. When Hunter.io or similar services return related email addresses, the -ch flag automatically adds these new targets to the ongoing search. This recursive discovery reveals organizational hierarchies, supply chain relationships, and hidden attack vectors. The --power-chase option extends this capability further, aggressively pursuing secondary and tertiary connections.

Performance-Optimized Multiprocessing

Local searches leverage Python's multiprocessing module, spawning separate worker processes for each file. This architecture maximizes CPU utilization across cores, turning massive breach compilations into searchable databases in minutes rather than hours. The -sf (single-file) flag provides a progress bar for large individual files, trading concurrency for visibility when needed.

Demonstration-Ready Privacy Controls

The --hide flag redacts passwords from output, transforming h8mail into a safe demonstration tool for security awareness training. This feature lets professionals showcase breach risks without exposing sensitive credentials, making it perfect for board presentations, client meetings, and educational workshops.

Real-World Use Cases Where h8mail Excels

Incident Response and Breach Validation

When your Security Operations Center detects suspicious account activity, h8mail becomes your first investigative tool. Within seconds, you can query an affected email across multiple breach databases to determine if credentials were recently exposed. This rapid triage answers critical questions: Is this a targeted attack or part of a broader credential stuffing campaign? Did the compromise stem from a known breach or a new data leak? The tool's JSON output integrates directly into incident ticketing systems, automatically enriching alerts with breach context and timestamps.

Penetration Testing Reconnaissance

During the information gathering phase of a penetration test, h8mail reveals the external attack surface. Starting with a domain name, testers use the URL parsing feature to harvest email addresses from the corporate website, then chase related addresses to map the organizational structure. Querying these emails against local breach compilations often yields valid credentials for initial access. The tool's ability to search by username patterns (--loose) helps identify personal email accounts used by employees, bypassing corporate security controls.

Continuous Threat Intelligence Monitoring

Security teams schedule daily h8mail scans against their employee directory, receiving automated alerts when staff emails appear in new breaches. This proactive approach enables immediate password resets before criminals exploit the credentials. The CSV output feeds into risk scoring systems, quantifying the organization's exposure over time. By integrating with HaveIBeenPwned's API, teams detect breaches often weeks before they're publicly announced.

Digital Forensics and Malware Analysis

When analyzing compromised systems or malware configurations, investigators extract hardcoded email addresses and feed them to h8mail. The tool reveals whether these addresses belong to known threat actors, have been used in previous campaigns, or connect to broader infrastructure. Searching local breach databases helps attribute attacks to specific data leaks, providing crucial context for building threat actor profiles and understanding attack origins.

Security Awareness and Risk Demonstration

Human resources and security awareness teams leverage h8mail's --hide flag to demonstrate real-world breach impacts during training sessions. By showing employees their actual compromised accounts (without revealing passwords), the tool creates powerful, personal motivation for adopting stronger security practices. The colorful, easy-to-read output makes technical concepts accessible to non-technical stakeholders, bridging the communication gap between security teams and management.

Step-by-Step Installation & Setup Guide

Method 1: pip Installation (Recommended)

The simplest installation uses Python's package manager. Ensure you have Python 3.6+ installed:

# Install h8mail directly from PyPI
pip3 install h8mail

# Verify installation
h8mail --help

# Upgrade to latest version
pip3 install --upgrade h8mail

This method handles all dependencies automatically, requiring only the requests library. The tool installs system-wide, making it available in any terminal session.

Method 2: Docker Deployment

For isolated environments or CI/CD pipelines, use the official Docker image:

# Pull the latest image
docker pull kh4st3x00/h8mail

# Run h8mail in a container
docker run --rm -it kh4st3x00/h8mail --help

# Mount local breach data for scanning
docker run --rm -it -v /path/to/breaches:/data kh4st3x00/h8mail -t target@example.com -lb /data

Docker ensures consistent behavior across different operating systems and prevents dependency conflicts with other security tools.

Method 3: GitHub Source Installation

For development or bleeding-edge features, install from source:

# Clone the repository
git clone https://github.com/khast3x/h8mail.git
cd h8mail

# Install in development mode
pip3 install -e .

# Verify installation
h8mail --help

Configuring API Keys

Create a configuration file (e.g., config.ini) to store API credentials:

[h8mail]
snusbase_key=your_snusbase_key
hunterio_key=your_hunterio_key
hibp_key=your_haveibeenpwned_key
dehashed_key=your_dehashed_key
intelx_key=your_intelx_key
emailrep_key=your_emailrep_key
leaklookup_key=your_leaklookup_key

Save this file with restricted permissions:

chmod 600 config.ini

Setting Up Local Breach Data

For offline capabilities, download breach compilations like "Collection #1" or the "Breach Compilation" torrent. Extract them to a dedicated directory:

# Create breach data directory
mkdir -p ~/breach-data

# Extract Collection1
tar -xzf collection1.tar.gz -C ~/breach-data/

# Set proper permissions
chmod -R 600 ~/breach-data/

h8mail will automatically detect and process both cleartext and compressed files within this directory structure.

REAL Code Examples from the Repository

Example 1: Basic Email Breach Check

This fundamental command queries all default services for a single email address:

# Query a single target against default services
h8mail -t victim@example.com

What happens behind the scenes:

• The -t flag accepts the target email as a string
• h8mail first validates the email format using its regex engine
• It queries HaveIBeenPwned Public API for breach count
• Hunter.io Public API searches for related emails
• Scylla.so checks for cleartext credentials
• Results display in color-coded terminal output
• Breach names, dates, and sources appear in structured format

Sample output structure:

[victim@example.com]
├── Breach Count: 7
├── Breaches: [LinkedIn2012, MySpace2008, Adobe2013]
├── Related Emails: 12 found
└── Sources: HaveIBeenPwned, Hunter.io, Scylla

Example 2: Bulk Target Processing with CSV Output

Process thousands of emails from a file and export results for analysis:

# Read targets from file, save results to CSV
h8mail -t targets.txt -o breach_results.csv

Technical breakdown:

• targets.txt contains one email per line (supports globbing patterns)
• The file reader uses a generator to handle large files efficiently
• Each email gets processed through configured services
• The -o flag triggers CSV export using Python's csv module
• Output includes: target email, breach count, breach names, data classes, first/last seen dates
• Memory usage remains constant regardless of input file size

targets.txt format:

admin@company.com
ceo@company.com
it-support@company.com
# Comments are ignored
*.temp@company.com  # Supports patterns

Example 3: Local Breach Compilation Search

Search offline breach data for maximum privacy and speed:

# Scan local breach data with multiprocessing
h8mail -t suspect@example.com -lb ~/breach-data/Collection1/ -gz ~/breach-data/archives/

Deep dive into functionality:

• -lb scans cleartext files in the specified directory
• -gz handles compressed .tar.gz archives automatically
• Each file spawns a separate process via Python's multiprocessing.Pool
• The tool searches for exact email matches and common variations
• Progress displays per-file when using -sf flag for large files
• Results aggregate across all scanned sources
• No API calls made—completely offline operation

Performance optimization:

# Use single-file mode for progress tracking on massive archives
h8mail -t target@example.com -gz ~/breach-data/50GB-archive.tar.gz -sf

Example 4: Advanced Query with Premium APIs and Chasing

Leverage paid services for deeper intelligence and automatic relationship discovery:

# Use config file, chase related emails, limit to 2 degrees, output JSON
h8mail -t executive@corp.com -c config.ini -ch 2 -j intel_report.json

Advanced parameter explanation:

• -c config.ini loads API keys for premium services (Snusbase, Dehashed, IntelX)
• -ch 2 enables chasing with a depth limit of 2 degrees of separation
• Hunter.io's related emails get automatically added to the search queue
• Each discovered email is recursively queried up to the depth limit
• --power-chase flag can extend this further for comprehensive mapping
• -j exports the complete intelligence graph to JSON
• JSON structure includes relationships, metadata, and query timestamps

Sample JSON output structure:

{
  "targets": ["executive@corp.com"],
  "chase_depth": 2,
  "results": {
    "executive@corp.com": {
      "breaches": [...],
      "related_emails": ["assistant@corp.com", "personal@gmail.com"],
      "credentials": [...]
    }
  },
  "metadata": {"query_time": "2024-01-15T10:30:00Z"}
}

Example 5: Custom Query for Non-Email Targets

h8mail's flexibility extends beyond emails to support various intelligence indicators:

# Search for username in breach data
h8mail -q "darklord42" --loose -lb ~/breach-data/

Custom query capabilities:

• -q flag accepts usernames, IP addresses, domains, hashes, or passwords
• --loose disables email validation, enabling broad pattern matching
• Searches local breach data for any occurrence of the query string
• Useful for finding all accounts associated with a known alias
• Supports threat actor attribution and infrastructure mapping
• Can pivot from a password hash to find reused credentials

Advanced Usage & Best Practices

Optimizing Multiprocessing Performance

For massive breach datasets, tune your system for maximum throughput:

# Limit concurrent processes to prevent system overload
export H8MAIL_MAX_WORKERS=8
h8mail -t targets.txt -lb /mnt/breaches/ --single-file

Monitor system resources and adjust workers based on CPU cores and available RAM. SSD storage dramatically improves performance over HDD for local scans.

Stealth and Operational Security

When querying external APIs, maintain operational security:

# Use Tor proxy for anonymous queries
proxychains h8mail -t target@example.com -c config.ini

# Rate limit requests to avoid detection
h8mail -t targets.txt --timeout 5  # Adds delay between API calls

Always respect service terms of use. Rotate API keys between investigations and monitor usage quotas to avoid service interruptions.

Building Automated Monitoring Pipelines

Integrate h8mail into cron jobs for continuous monitoring:

# Daily breach check script
crontab -e
# Add: 0 9 * * * /usr/local/bin/h8mail -t /opt/monitoring/employees.txt -j /var/log/breaches/$(date+\%Y-\%m-\%d).json

This creates timestamped JSON reports for SIEM ingestion and trend analysis.

Combining with Other OSINT Tools

Chain h8mail with reconnaissance tools for comprehensive investigations:

# Extract emails from domain, then check breaches
theharvester -d targetcorp.com -b all | grep '@' | h8mail -t - -o results.csv

This pipeline automates the entire process from domain enumeration to breach validation.

Comparison with Alternative Tools

Why choose h8mail? Its unique combination of local breach processing, premium API aggregation, and intelligent email chasing creates a workflow efficiency that no single alternative matches. While TheHarvester excels at initial domain reconnaissance and Recon-ng offers unparalleled framework extensibility, h8mail specializes in the critical pivot from discovered emails to actionable breach intelligence. This focused specialization makes it faster, more comprehensive, and easier to deploy for breach-specific investigations.

Frequently Asked Questions

What exactly is h8mail used for?

h8mail is an email OSINT tool that checks if email addresses appear in data breaches. It queries public databases like HaveIBeenPwned, premium services like Dehashed and Snusbase, and local breach compilations to find compromised credentials, related email addresses, and breach metadata. Security professionals use it for incident response, penetration testing, threat intelligence, and digital forensics.

Is using h8mail legal and ethical?

Yes, when used responsibly. Querying public breach databases for emails you own or have explicit permission to investigate is legal. Always obtain proper authorization before scanning organizational accounts. Never use h8mail to stalk, harass, or illegally access accounts. The tool includes a --hide flag specifically for ethical demonstrations that redact passwords from output.

How do I obtain API keys for premium services?

Most premium services offer free tiers or trial periods:

• HaveIBeenPwned: Purchase API key from haveibeenpwned.com/API/Key
• Hunter.io: Sign up at hunter.io for free tier (50 searches/month)
• Snusbase: Purchase credits at snusbase.com/admin/purchase
• Dehashed: Subscribe at dehashed.com
• IntelX: Free trial available at intelx.io/signup

Add keys to your config.ini file under the appropriate service sections.

Can h8mail search my own local breach data?

Absolutely. The -lb (local breach) and -gz (gzip) flags scan offline files without sending data to external services. This is perfect for:

• Compliance-sensitive investigations
• Processing massive datasets quickly
• Maintaining operational security
• Avoiding API rate limits

Simply point h8mail to your breach compilation directories and it will automatically detect and process supported file formats using multiprocessing.

What's the difference between regular and "loose" search modes?

Regular mode validates email formats strictly, ensuring only properly formatted addresses are queried. Loose mode (--loose) disables email validation, allowing searches for usernames, partial emails, or any text pattern. This is essential for:

• Finding all variations of a username across services
• Searching breach data for non-email identifiers
• Discovering related accounts using pattern matching
• Investigating threat actor aliases

How does email chasing work, and when should I use it?

Email chasing (-ch) automatically queries email addresses related to your target. When services like Hunter.io return "related emails," h8mail adds them to the search queue and investigates them recursively. Use it when:

• Mapping organizational structures
• Discovering supply chain relationships
• Finding personal accounts of key personnel
• Building comprehensive attack surface profiles

Set a depth limit (e.g., -ch 2) to prevent infinite recursion, and use --power-chase for aggressive discovery during authorized penetration tests.

Is h8mail free to use?

The core tool is completely free and open-source under the AGPL license. You can query public services and scan local breaches without any cost. Premium features require paid API keys from services like Snusbase or Dehashed, but h8mail itself charges nothing. This model lets you start with free tiers and scale up as investigation needs grow.

Conclusion: Why h8mail Belongs in Your Security Toolkit

h8mail represents a paradigm shift in email OSINT investigations, transforming fragmented, manual breach checks into a streamlined, automated intelligence operation. Its genius lies not in reinventing breach databases, but in orchestrating them—creating a unified interface that respects both your time and your operational security requirements.

The tool's multiprocessing architecture turns massive breach compilations from intimidating data mountains into searchable intelligence goldmines in minutes. Its premium API integrations provide depth that free services alone cannot match, while the local search capabilities ensure privacy and speed when investigating sensitive incidents. The email chasing feature alone justifies adoption, revealing organizational relationships that would require hours of manual correlation to discover otherwise.

For penetration testers, h8mail accelerates the reconnaissance phase, quickly delivering actionable credential intelligence. For incident responders, it provides immediate breach context that shapes containment strategies. For threat intelligence teams, it automates the tedious monitoring that prevents credential stuffing attacks. And for security awareness professionals, it demonstrates real-world risks without exposing sensitive data.

The active development community and regular updates ensure h8mail stays relevant as new breach sources emerge. Its Python foundation makes it extensible, while the Docker deployment option guarantees consistent performance across any environment.

Ready to revolutionize your breach hunting capabilities? Visit the official GitHub repository at https://github.com/khast3x/h8mail to download the tool, access the wiki, and join the community of security professionals already leveraging h8mail's powerful OSINT capabilities. Star the repository to show your support and receive updates on new features and breach data sources.

In an era where credentials are currency, h8mail is the essential tool that ensures you're never blind to the breaches that matter most.