These are very good points. 1. Good idea 2. Good point, however, these credentials are usually already posted in public forums. My thoughts were that the risk

These are very good points. 1. Good idea 2. Good point, however, these credentials are usually already posted in public forums. My thoughts were that the risk was already present-- and the person who potentially didn't know was the user. 3. I am patiently waiting on let's encrypt. As a side project with no income, I cannot justify the cost of a certificate. 4. I found based on some responses that some of the credentials were old. It was not my intention to verify exposure, but let the user know that I found a password. If the person recognizes it for any account, change it. I don't know if this is a service that can be maintained for any period of time, but hopefully the unexpected emails helped someone before the service could be abused.