Methodology and Limitations

EmailFootprint uses the email address you submit as its only search key. It checks available sources for the submitted address, its deterministic hash or its domain. Results are not used to search for other identities.

1. Sources and what each one receives

Sources run only when configured and applicable. A source that fails or times out has not established that the address is absent. Multiple search engines can return overlapping results; broader coverage is not a guarantee of more findings.

Web search via SerpApi (SerpApi, LLC): receives the email address you submit. Google and Bing are the default engines. DuckDuckGo, Yahoo, Yandex and SerpApi Search Index are optional engines when enabled and available. They share one search allowance within this source. Queries may cover the exact address, common obfuscated forms, documents and selected sites. Duplicate URLs are checked once, preserving which engines found them.
Brave Search (Brave Software, Inc.): receives the email address you submit. When configured, runs a smaller set of searches alongside the SerpApi source.
Have I Been Pwned (Superlative Enterprises Pty Ltd): receives the email address you submit. Known data breaches (with the breach date and the types of data exposed) and paste records (source, ID and date only; paste contents are never fetched).
GitHub (GitHub, Inc.): receives the email address you submit. Public commits whose author or committer address matches, reported as repository, commit link, date and number of commits.
keys.openpgp.org: receives the email address you submit. Whether a public PGP key is published for it, its creation date and how many identities it lists.
Gravatar (Automattic Inc.): receives only a SHA-256 hash of your email address. Whether a public profile exists, which kinds of details it shows and how many linked accounts it has.
Domain registration (RDAP), run by domain name registries: receives only the domain name of your email address, and only for addresses outside the recognized free-email-provider list; it never receives the email address. Whether the address is listed as a registration contact. Most registries now redact this.
Wayback Machine (Internet Archive): receives only the web addresses (URLs) of pages found in your scan; it never receives the email address. URLs containing the submitted email are excluded. Archive checks can confirm an available copy containing the address when it is no longer found on the accessible live page; they do not establish the first publication or removal date.

2. How results are verified

Search engines return pages that may contain the address. EmailFootprint opens each one (up to 40 per scan) and only reports it if the address is actually on the page, in any of these forms: exact, [at], (at), with spaces, URL-encoded, or as an email link. Web pages, PDFs and Word and Excel files are read. Pages that need JavaScript to show their content, or that cannot be opened, are never reported as found; they are counted in the coverage record.

Breach, paste, commit, profile, key and registration results come directly from the source and are reported as confirmed by that source.

3. What is reported, and what is not

EmailFootprint reports exposure, not identity. Where a public profile or key contains personal details (such as a name, location or employer), the report says that kind of detail is present, never the detail itself. Nothing found in results (names, usernames, other addresses) is ever used to run further searches.

What is not checked

Private or authenticated content, and social media content that requires a login
Content excluded from search engine indexing
Dark web sources and stealer logs
Data broker databases
Whether an account exists on a site (no login or password-reset checks)
Leaked passwords or other credentials in plain text
Breaches not yet disclosed or not included in Have I Been Pwned

A "no results" outcome

Every report ends with a coverage record listing each source and what it returned, including sources that did not apply, timed out or failed. No findings means the completed checks produced no reportable exposure. Failed, timed-out or unfinished checks leave gaps. It does not guarantee that no exposure exists.

Scan duration

Scanning takes up to 90 seconds. Two scans can run at the same time. When both slots are occupied, you may wait up to 60 seconds before scanning starts; waiting plus scanning can take up to 150 seconds. Work that cannot finish within its allotted time is stopped and marked in the coverage record. Checkout, network delivery and page loading are separate from that processing budget.