Logoutify Console

A bring-your-own-key workbench for the Logoutify threat-intelligence API. Every documented method, bulk scans, a watchlist for your own assets, a request lab and local-only history, in a fast, private, installable web app. No build step, no backend of its own, no tracking.

Live: https://brosg.github.io/logoutify-console/

Paste your Logoutify API key once. It stays in your browser and is sent only to the relay that forwards it to logoutify.com.

More screenshots

What it covers

Area	Methods / features
Breach data	email, username, ip, expanded (print_r output parsed into records)
Threat intelligence	general (Pastebin), blockchain (BTC/ETH due diligence), kev_cve (CISA KEV), threatactors*
Web & public records	domain, reddit, ycombinator, police_uk
Utilities	email_disposable, custom method + arbitrary extra query parameters (forward-compatible)
Bulk	Parallel single queries (any plan, any method, concurrency control, cancel) and the native api_file endpoint (bulk plan; list hosted statelessly by the relay or your own .txt/.csv URL)
Scan all	One keystroke runs every method that fits the detected input type (email, IP, domain, CVE, crypto address, hash, …)
Results	Purpose-built cards per shape (breach records, pastes, blockchain profile, KEV/CVE with remediation countdown, disposable verdict), sortable/filterable table, highlighted JSON, raw body, sandboxed HTML preview
Export	CSV (injection-safe), normalised JSON, raw response, Markdown report
Watchlist	Re-check your assets on demand; new records since the last check are flagged
History	Local, filterable, re-runnable, exportable
Request Lab	Hand-craft any api_usage / api_file call, see the exact upstream URL, copy a cURL
Key safety	localStorage / session-only / AES-GCM passphrase lock (PBKDF2 310k) · one-click key test · plan/quota diagnostics
UX	Command palette (Ctrl K), keyboard shortcuts, dark/light themes, responsive, PWA offline shell

* Search-engine categories the docs attribute to bulk / unlimited plans. Response shapes are undocumented, so they render generically.

Architecture

Browser (GitHub Pages, static)  ──TLS, Authorization: Bearer──▶  Relay (Cloudflare Worker)  ──TLS, ?key=──▶  logoutify.com
          site/                                                      worker/

logoutify.com sends no CORS headers, so browsers cannot call it directly. The relay is a stateless pass-through (~200 lines, worker/src/index.js): it forwards the request, adds CORS headers and returns the upstream body unchanged. No storage binding, logging disabled. A default instance is configured; deploying your own takes a minute:

cd worker
npx wrangler login
npx wrangler deploy        # → https://logoutify-relay.<your-subdomain>.workers.dev

Then Settings → Relay in the console. ALLOWED_ORIGINS in worker/wrangler.toml restricts which sites may use it.

Run locally

git clone https://github.com/BrosG/logoutify-console
cd logoutify-console
npx serve site            # or: python -m http.server -d site 8080

Open http://localhost:3000 (the default relay already allows localhost and 127.0.0.1 on any port).

Project layout

site/                      static app (deployed to GitHub Pages)
  index.html
  assets/css/app.css       design system (dark/light, responsive)
  assets/js/main.js        orchestration: views, search, bulk, watchlist, history, lab, docs, settings
  assets/js/methods.js     method registry, plans, upstream error catalogue
  assets/js/detect.js      input-type detection → suggested methods / scan plan
  assets/js/parse.js       response normalisation (JSON · strings · print_r · HTML)
  assets/js/render.js      renderers per shape + table/json/raw views
  assets/js/api.js         relay client
  assets/js/bulk.js        list parsing, concurrency pool
  assets/js/store.js       settings, key storage (plain / session / encrypted), history, watchlist
  assets/js/export.js      CSV / JSON / Markdown
  assets/js/ui.js          DOM helpers, toasts, modals, palette
worker/                    Cloudflare Worker relay (wrangler)
.github/workflows/pages.yml  CI: syntax check + Pages deploy

Upstream API (as documented by Logoutify)

GET https://logoutify.com/api_usage?method=$Method&key=$Key&query=$Query
GET https://logoutify.com/api_file?api_method=$Method&api_key=$Key&bulk_url=$URL   (bulk plan)

Methods: email · username · ip · email_disposable · general · blockchain · kev_cve · expanded. Errors arrive as sentences (Invalid or expired API key., You have exceeded the limit of queries…, …); the console maps them to codes and hints. Official docs: https://logoutify.com/documentation · Pricing: https://logoutify.com/home#api-pricing

Privacy

• Key, history, watchlist and settings never leave the browser except the key → relay → logoutify.com hop.
• No analytics. Only external resources: Google Fonts. Referrer-Policy: no-referrer.
• HTML responses are rendered as text; the optional preview is a fully sandboxed iframe.

Responsible use

Logoutify's terms require using the API only to improve the security of your own services and products, to keep any obtained information secure, and to follow applicable law. This console is built for that: checking the exposure of accounts, domains and infrastructure you are responsible for. It is an independent project, not affiliated with Logoutify.

License

MIT © Bros G