MyRecon App for Android

MyRecon is an Android app for public username search, digital footprint research and breach checks. Run username checks from your phone and review the source links.

The Play listing is currently available only to eligible closed testers. Public release is coming soon.

Why on-device matters

This is not a wrapper around the website. The username sweep runs from the handset, and that produces better results for a reason worth understanding: platforms rate-limit and block datacentre address ranges far more aggressively than residential and mobile ones. The same check that a cloud server gets refused for, a phone is usually answered for. Running it on your device is both faster and more accurate.

What it does

Username sweep

Social, developer, gaming, marketplace, forum and portfolio sites, checked concurrently. Each result is verified rather than assumed: a platform returning HTTP 200 is not treated as proof an account exists, because a great many sites answer 200 for every handle ever typed. Findings are labelled by confidence, and anything the app could not confirm says so instead of being presented as a match.

Breach alerts, without handing over your address

The app downloads the public breach catalogue and compares it on your device. There is no account and no address is sent anywhere, which is the opposite of every hosted breach-alert service, all of which require your email up front. If you want the stronger per-address check, that is a separate switch with its own disclosure, so the default promise stays true.

QR link safety

Scan a QR code and see where it actually goes before you open it, the full redirect chain, the final destination, and whether anything about it looks like a lookalike domain.

Password leak check

Check whether a password already appears in known breach corpora, without sending it anywhere. The app hashes it on the handset and sends only the first five characters of that hash, so the service answering cannot work out which password was asked about, and never receives the password itself.

Domain, DNS and IP lookups

Registration details over RDAP, mail authentication read from the domain's own published SPF, DKIM and DMARC records, subdomains recovered from Certificate Transparency logs, and geolocation for an address. Every source is public and keyless.

Identity correlation

Accounts that appear to belong to the same person are grouped, with a confidence score and the signals behind it. A matching handle alone is never treated as proof of identity.

Availability

The Android app is in closed testing on Google Play. Only eligible testers can access the listing until public release. It requires Android 11 or newer. The web version at myrecon.xyz works on any device and needs no installation.