Burned — OSINT on myself, or why I didn't build a people search engine
An order came in as simple as a wire: “build a tool where you enter a number, email, or name, and it spits out everything about that person on the internet.” Sounds like every would-be investigator’s dream. Also sounds like an indictment under Article 190a of the Penal Code. So I sat down and explained why I wouldn’t do that — then built something that actually makes sense.
What I DIDN’T build (and why)
An “everything about any person” engine isn’t OSINT; it’s a doxxing machine. You enter someone else’s data without consent → profile a human being without legal basis. That’s GDPR up to the ankles (fines calculated as a percentage of turnover), plus the added benefit of facilitating harassment and stalking. As the site owner, I would be the data controller and I’d be the one held responsible. Besides, most of these “people search engines” feed on leak databases — i.e., stolen goods.
Short version: there is no legal version of “check any Kowalski.” There is, however, a legal and genuinely useful version: check yourself.
spalony — OSINT, but on yourself
I named it spalony because that’s exactly what it’s about: how much the internet already knows about you before an unauthorized person finds out. You enter your own data and see your digital footprint through the eyes of a stranger. What it does:
- Leaks — whether your email appeared in known breaches (HaveIBeenPwned).
- Passwords — whether your password is sitting in a compromised database.
- Nickname — where your handle has accounts: ~27 platforms at once (GitHub, Reddit, IG, TikTok, Wykop…), plus Gravatar.
- Phone — country, type, operator. Without owner identification — I’ll leave that to stalkers in movies.
- Dorks — ready-to-click queries for Google/Bing/DDG so you can finish manually.
A password that never leaves your browser
My favorite part. Password checking works on k-anonymity: the browser computes a SHA-1 hash locally and sends me only the first five characters. The rest of the matching happens on your end. So: I check your password without ever seeing it. Yes, it’s possible. No, I don’t keep anything — the audit logs only store an anonymous IP hash for bot catching, zero personal data.
What else is in the works
The email leak module is waiting for a HaveIBeenPwned API key (a tiny paid fee) — I’ll hook it up soon. The rest — passwords, nicknames, phone, dorks — is already running. Hence the honest 🚧 under construction on the site instead of pretending everything is ready. Honesty over marketing, as usual.
Access
You’ll find it under Projects → spalony, or directly: esej.space/slad. Enter your email. See how many traces you’ve left behind. Then enable 2FA, like any normal person should have done two years ago.
// check yourself before someone else does. back to work.