Powerful and user-friendly password finder.
Use h8mail to find passwords through different breach and reconnaissance services, or using local breaches such as Troy Hunt’s “Collection1” or the infamous “Breach Compilation” torrent.
- Email pattern matching (reg exp), useful for reading from other tool outputs
- Loosey patterns for local searchs (“john.smith”, “evilcorp”)
- Painless install. Available through
pip, only requires
- Small and fast Alpine Dockerfile available
- CLI or Bulk file-reading for targeting
- Output to CSV file
- Compatible with the “Breach Compilation” torrent scripts
- Search .txt and .gz files locally using multiprocessing
- Compatible with “Collection#1”
- Get related emails
- Chase and target related emails in ongoing search
- Supports premium lookup services for advanced users
- Regroup breach results for all targets and methods
- Includes option to hide passwords for demonstrations
- Delicious colors
|HaveIBeenPwned||Number of email breaches||yes|
|Hunter.io – Public||Number of related emails||yes|
|Hunter.io – Service (free tier)||Cleartext related emails||yes|
|WeLeakInfo – Public||Number of search-able breach results||no|
|WeLeakInfo – Service||Cleartext passwords, hashs and salts||no|
|Snusbase – Service||Cleartext passwords, hashs and salts – Fast||yes|
|Leak-Lookup – Public||Number of search-able breach results||yes|
|Leak-Lookup – Service||Cleartext passwords, hashs and salts||yes|
h8mail 2.0 only requires the python
requests module to run.
To install h8mail, run this command in your terminal:
$ pip3 install h8mail
And that’s basically it.
This is the preferred method to install h8mail, as it will always install the most recent stable release.
The above illustration showcases installing h8mail using
The sources for h8mail can be downloaded from the Github repo.
You can either clone the public repository:
$ git clone git://github.com/khast3x/h8mail
Or download the tarball:
$ curl -OL https://github.com/khast3x/h8mail/tarball/master
Next, decompress the downloaded archive.
Once you have a copy of the source, you can install it with:
$ cd h8mail/ $ python setup.py install $ h8mail -h
Or just running it as a module:
$ cd h8mail/ $ python -m h8mail -h
$ pip3 install --upgrade h8mail
--user at the end if getting a permission message from pip
$ docker run -ti kh4st3x00/h8mail -h
usage: h8mail [-h] -t TARGET_EMAILS [TARGET_EMAILS ...] [--loose] [-c CONFIG_FILE [CONFIG_FILE ...]] [-o OUTPUT_FILE] [-bc BC_PATH] [-sk] [-k CLI_APIKEYS [CLI_APIKEYS ...]] [-lb LOCAL_BREACH_SRC [LOCAL_BREACH_SRC ...]] [-gz LOCAL_GZIP_SRC [LOCAL_GZIP_SRC ...]] [-sf] [-ch [CHASE_LIMIT]] [--hide] Email information and password lookup tool optional arguments: -h, --help show this help message and exit -t TARGET_EMAILS [TARGET_EMAILS ...], --targets TARGET_EMAILS [TARGET_EMAILS ...] Either string inputs or files. Supports email pattern matching from input or file, filepath globing and multiple arguments --loose Allow loose search by disabling email pattern recognition. Use spaces as pattern seperators -c CONFIG_FILE [CONFIG_FILE ...], --config CONFIG_FILE [CONFIG_FILE ...] Configuration file for API keys. Accepts keys from Snusbase, (WeLeakInfo, Citadel.pw), hunterio -o OUTPUT_FILE, --output OUTPUT_FILE File to write CSV output -bc BC_PATH, --breachcomp BC_PATH Path to the breachcompilation torrent folder. Uses the query.sh script included in the torrent. https://ghostbin.com/paste/2cbdn -sk, --skip-defaults Skips HaveIBeenPwned and HunterIO check. Ideal for local scans -k CLI_APIKEYS [CLI_APIKEYS ...], --apikey CLI_APIKEYS [CLI_APIKEYS ...] Pass config options. Supported format: "K=V,K=V" -lb LOCAL_BREACH_SRC [LOCAL_BREACH_SRC ...], --local-breach LOCAL_BREACH_SRC [LOCAL_BREACH_SRC ...] Local cleartext breaches to scan for targets. Uses multiprocesses, one separate process per file, on separate worker pool by arguments. Supports file or folder as input, and filepath globing -gz LOCAL_GZIP_SRC [LOCAL_GZIP_SRC ...], --gzip LOCAL_GZIP_SRC [LOCAL_GZIP_SRC ...] Local tar.gz (gzip) compressed breaches to scans for targets. Uses multiprocesses, one separate process per file. Supports file or folder as input, and filepath globing. Looks for 'gz' in filename -sf, --single-file If breach contains big cleartext or tar.gz files, set this flag to view the progress bar. Disables concurrent file searching for stability -ch [CHASE_LIMIT], --chase [CHASE_LIMIT] Add related emails from HunterIO to ongoing target list. Define number of emails per target to chase. Requires hunter.io private API key --hide Only shows the first 4 characters of found passwords to output. Ideal for demonstrations
$ h8mail -t firstname.lastname@example.org
$ h8mail -t targets.txt -c config.ini -o pwned_targets.csv
Query a list of targets against local copy of the Breach Compilation, pass API keys for Snusbase from the command line
$ h8mail -t targets.txt -bc ../Downloads/BreachCompilation/ -k "snusbase_url=$snusbase_url,snusbase_token=$snusbase_token"
$ h8mail -t targets.txt -bc ../Downloads/BreachCompilation/ -sk
$ h8mail -t targets.txt -gz /tmp/Collection1/ -sk
$ h8mail -t email@example.com -lb /tmp/4k_Combo.txt -ch 10 -k "hunterio=ABCDE123"
Configuration file & keys
h8mail can read keys by using a
config.ini file with
-c, or by passing keys from the command line directly with
The configuration file format is as follows:
[h8mail] hunterio = snusbase_url = snusbase_token = ; leak-lookup_pub = 1bf94ff907f68d511de9a610a6ff9263 leak-lookup_priv = weleakinfo_pub = weleakinfo_priv =
In the above example, you’ll notice a Leak-lookup public key, graciously generated for h8mail users. To activate, uncomment the line and make sure to pass to config file. The API can sometimes timeout. If that’s the case, simply relaunch.
Keys and their respective values can also be passed from the command line, with the
-k option. Format is like so:
$ h8mail -t firstname.lastname@example.org -k "K=V, K=V" "K=V" $ h8mail -t email@example.com -k "leak-lookup_pub=1bf94ff907f68d511de9a610a6ff9263"
- The above instructions assume you are running python3 as default. If unsure, type the following in your terminal.
It should be either
$ python --version
- If you are running python2 as default :
Make sure you have python3.6+ installed, then replace
pythoncommands with explicit
- If you have not set your venvs, you might get a permission error saying
Consider using the --user option or check the permissions.
Simply add –user like so:
$ pip install --user h8mail
h8mailuses ANSI color escape characters. Windows doesn’t know how to show the colors, and will show gibberish instead.
Fortunately, you can use Cmder, which is an excellent Windows CMD prompt alternative
- If you’re having trouble with python and pip, chances are you need to add python to your PATH.
pipwill also need to be in your
- If you’re still having trouble with
pip, you can do the following:
# Check python version, should be 3.6+ C:> python --version # To have python handle installation of pip C:> python -m ensurepip # To launch pip as a module C:> python -m pip install h8mail # To launch h8mail as a module C:> python -m h8mail --help
- As described for Windows, you might encounter issues with python if your installation is incomplete, or
pip‘s installation directory is not in your PATH.
- If thats the case, you can try invoking
h8mailwith the same command lines as Windows.
- Make sure the
pythoncommand refers to Python 3 with
python --version, otherwise replace
python3in the instructions.
- Basically try this if installed and not executing, check Windows instructions for further examples:
$ python3 -m h8mail -h