> ## Documentation Index
> Fetch the complete documentation index at: https://docs.periphery.exposed/llms.txt
> Use this file to discover all available pages before exploring further.

# Emails and credentials

> How Periphery finds email addresses and credentials on a page, what verified means, and what each plan shows.

## Email addresses

Addresses are extracted from the rendered page: the visible text, `mailto:` links, and inline script data. They are lower-cased and de-duplicated. Every plan sees the full list on an app page and in the API, and the `email:` filter is available to everyone.

An address on a page is not proof of anything beyond its presence there. Contact addresses, marketing footers, and example data all appear.

## Credentials

After the page is rendered, its source is scanned for strings that match the shape of an API key, token, or secret: cloud provider keys, payment and messaging service tokens, database URIs, and hundreds of other formats. Each match is a **finding** with the name of the **detector** that matched it.

A finding is **verified** when the scanner was able to confirm it with its issuer at snapshot time, for example by making an authenticated call that succeeded. Unverified findings are kept too; they may be revoked, malformed, or placeholders, and the format alone is no guarantee.

Verification happened at snapshot time. A verified credential may have been revoked since; an unverified one may never have been valid.

## What each plan sees

|                                          | Free | Plus | Pro |
| ---------------------------------------- | ---- | ---- | --- |
| Email addresses                          | yes  | yes  | yes |
| Whether an app has a verified credential | yes  | yes  | yes |
| Names of the detectors that verified     | yes  | yes  | yes |
| Raw credential strings                   | no   | yes  | yes |
| `has:creds` filter                       | no   | yes  | yes |

On the Free plan an app page shows the detector names with a lock in place of the raw strings. The API, available on Plus and Pro, includes the `credentials` array whenever there are findings.

## Using what you find

A credential surfaced by Periphery may be used only to notify its owner. Using it to access, change, or disrupt a system you are not authorised to test breaches the [acceptable use policy](/policies/acceptable-use) and, in most places, the law. If you are the owner, revoke the credential first and then fix the page that leaked it: taking the page down does not revoke the key.