MnemoBreach

Where your data has leaked, and what to do about it.

Search your own email in known breaches, test a password, and put each breach on a timeline with the steps to take. Answers come from Have I Been Pwned and XposedOrNot. No breach file is ever downloaded.

Nobody can remove your data from a leak. MnemoBreach says so on its first screen.

The cartridge id is @mnemosyne-plugins/mnemo-breach. Its code lives at Mnemosyne-OS/MnemoBreach.

Your identifiers

Under Your identifiers, add your own email addresses and phone numbers. They stay on your computer, stored unencrypted in the app's settings, and are shown masked. Hold to show reveals one. Phone numbers cannot be searched yet.

Search your emails

Search your emails in known breaches sends the email you choose, and nothing else.

• Without a key, the search goes to XposedOrNot, a free service. Its dates are known to the year only.
• With your own Have I Been Pwned key, the search goes to Have I Been Pwned: dates to the day and its own list of breaches. The key is paid, on haveibeenpwned.com. Press Use my Have I Been Pwned key, paste it, then Save the key. It is sealed on your computer.

A result reads In N known breaches or Absent from the known breaches. Absent does not make an address safe. Have I Been Pwned leaves the breaches it marks as sensitive out of this search.

Remember this result saves it in MnemoBreach's own vault. The chat reads it once you unlock that vault in the vault panel. Forget the saved results removes them.

Without the app links to the same free search and alert on haveibeenpwned.com.

Test a password

Test a password hashes the password on your computer. Only the first 5 characters of the hash are sent. The answer says how many times it was seen in known breaches.

All known breaches

All known breaches is the public list of Have I Been Pwned. Search a service or a domain. Each breach shows when it happened, when it was made public, the number of accounts and what leaked. Press I had an account here to put it on your timeline.

Your timeline

Each breach on Your timeline shows when it happened, when it was made public, when you learned of it, and your first action. Under What to do, tick the steps you took:

• Change the password of this service, and everywhere you reused it.
• Turn on two-factor sign-in.
• Watch for emails, calls and letters that quote this service.
• Scan your computers with an antivirus, when the leak came from malware.
• Change all your passwords, starting with your email and your bank.

MnemoBreach also warns when several of your addresses sit in one breach, or when a breach leaked your phone or postal address with your email.

New breaches and the watch

New breaches lists what was made public since your last visit, the ones on a service of your timeline first. Mark as seen resets it.

Turn on the watch checks once a day, with the window closed, whether a service of your timeline has a new breach, and notifies you. Have I Been Pwned sees the list of services, never your email. It runs only while Mnemosyne OS is open, and watches at most 12 services.

Where your data goes

• Your identifiers and your timeline stay in the app's settings on your computer.
• Your Have I Been Pwned key is sealed on your computer.
• A search sends one email address to XposedOrNot or Have I Been Pwned. A password test sends 5 characters of a hash.
• Saved results go to MnemoBreach's own vault, walled off until you unlock it.

For agents

Action	Effect	What it does
breaches	read	The timeline and the steps done or still to do
catalogue	read	Searches the public list of known breaches
declare	write	Puts a breach on the timeline
undeclare	write	Takes a declared breach off the timeline
markAction	write	Marks one protective step as done or not
markHandled	write	Marks every step of one breach as done
news	read	The breaches made public since the news was last seen
markNewsSeen	write	Marks the news as seen
watchOff	write	Turns off the background watch

Searching the person's email, testing a password and turning the watch on stay the person's own gestures.

Voice examples: "which breaches concern me", "I had an account at Adobe", "I changed my password for LinkedIn", "Adobe is handled".