Loading page
About this tool
Why an email quoting your old password is almost always a mass-mailed bluff, and the steps that actually reduce your risk.
An email that opens with a password you recognise and demands cryptocurrency is a mass-mailed extortion attempt built on a leaked credential list, not on access to your device. This page lists the ten hallmarks of that automated version — an old password, no evidence attached, nothing personal beyond the password, a crypto address, a 48-hour clock, a forged From line showing your own address — and reports how many of them your message matches. It also separates the real risk, which is password reuse and credential stuffing, from the claimed one, and gives the reporting routes for the US, UK and India.
Open Sextortion Email Anatomy Explainer on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
The password is real and the surveillance is not — the tool makes that distinction explicit instead of leaving you to guess.
The output is a concrete clean-up: which accounts share the password, which have a second factor, and how long changing them takes.
If genuine intimate material was actually shown, the guidance switches to image-based abuse reporting rather than treating it as a bluff.
Almost certainly not. These campaigns take address-and-password pairs from old website breaches and send millions of identical messages; the password is the only genuine item in the email. If no video or screenshot was actually attached and the message contains nothing personal beyond that password, there is no evidence of any access to your devices.
No. The From header of an email is free text and can be forged by any sender, which is why domains publish SPF, DKIM and DMARC records to fight it. Check your Sent folder: the message will not be there. Changing your password and turning on two-factor authentication is still worth doing.
No. There is nothing to buy back — the recording does not exist — and paying identifies your address as one that responds, which usually brings more demands. Instead, change the quoted password everywhere it is still used, enable two-factor authentication, and report the message.
Change the leaked password on every account that still uses it and stop reusing it; turn on two-factor authentication on email and banking first; check a breach-notification service to see which site exposed the password; and report the message to your national cybercrime body — ic3.gov in the US, Action Fraud in the UK, or cybercrime.gov.in and the 1930 helpline in India. If someone has genuinely shared intimate images of you, that is a crime — contact the police, and use StopNCII.org, or NCMEC's Take It Down service if the person depicted is under 18.