Is my information on the dark web?
For most people, "my information on the dark web" means one email from a company that was copied years ago, which a scan then calls the dark web. The file is sometimes on an onion site, sometimes on the ordinary web, and sometimes in a Telegram channel. The label doesn't say which, and it doesn't say anyone is using the file.
What you can learn comes from two lookups of that email, both free. The first is public. The second appears only after you prove the inbox is yours, and that is where a market's victim list and the website names from malware on a computer show up. A result that names no breach has skipped the second lookup. It also cannot see a copy that was never handed to the service you asked.
What to do in the next hour
- You have one email and you want the breaches
- Search it on Have I Been Pwned, then sign in and verify that same address. The public result skips sensitive breaches and stealer-log domains.
- The address came back in old breaches, or you reuse passwords
- Change the reused ones, the email account and the bank first, from a computer you trust. A password you already replaced with a unique one can stay. The breach row does not disappear when you change it.
- A computer might still be infected
- Run antivirus on it and let that finish before you type a new password there. A password changed on a machine that still has the malware is a password the malware gets.
- You are in the United States and the worry is new credit
- Freeze the file at Equifax, Experian and TransUnion. An email search cannot see a Social Security number. The freeze is free and it does not change your score.
- You were about to search onion sites for your own email
- You would be handing that email to whatever address someone gave you. The scams guide is how those cloned addresses get built. The check is on the ordinary web.
A breach, a stealer log, and a sale nobody published
Is my data on the dark web? Is my email on the dark web? Those are the same errand. The free check takes the email, not a name, a phone number or a government ID, and a hit on the email still doesn't say which of the three records you are looking at.
| Company breach | Stealer log | Sale that was never shared | |
|---|---|---|---|
| What it is | A service's user table, copied out of that service. | Malware on a computer, keeping the site, the email and the password from a login or from the browser's saved passwords. | A file sold or swapped in private. Nobody who runs a public index ever received a copy. |
| Public email search | Often the breach name. Not if Have I Been Pwned marked it sensitive. | No. It is not loaded as an ordinary breach row. | No. |
| After you verify the inbox | Sensitive breaches show up here. Genesis Market is one. | The website domain. Not the password next to your email. | Still no. |
| What reduces the harm | A new unique password on that account, and on every account that reused it. | Remove the malware before you type a new password on that computer. Then change the accounts whose domains came back. | No index that never received the file can alert you. Unique passwords, and a US credit freeze if new credit is the worry, don't depend on anyone finding it. |
Have I Been Pwned's FAQ says the service holds a small subset of records that have been breached over the years, that many breaches never result in a public release, and that many are never detected at all. The FAQ's line for a clean search is that absence of evidence is not evidence of absence. An address can also vanish from the results because the owner opted out, or because the breach was retired. Ticketek and VTech are the two retired ones the FAQ names.
How to find out, and what the free check withholds
How to find out if your information is on the dark web, without a subscription, is these three lookups. A dark web scan, including the free dark web scan in front of an identity-protection pitch, is a form over whatever corpus that company has already loaded. Dark web monitoring is the same match, run later and emailed to you. Google ran a consumer version and then shut it. Scans for new breaches stopped on 15 January 2026. On 16 February 2026 the dark web report itself was removed and the monitoring-profile data deleted. Google's reason was that the report didn't provide helpful next steps.
- Search the email on Have I Been Pwned. When addresses from a breach are loaded, the passwords are not loaded with them. You get names of incidents, and sometimes a flag, not a password sitting next to your address. The FAQ says the site does not keep a list of the addresses people search, and that the connection is encrypted. It also says the site uses Google Analytics.
- Sign in and verify the same address. This is the step a public "good news" skips. Sensitive breaches can only be searched by the verified owner of the address. Stealer logs, malware that collects the email, the password and the site they were entered on, are indexed too, and the FAQ says they are searchable through the notification service and a dedicated API. After you verify, what you see is the website domain, on your personal dashboard. You do not get the password back beside the email. Have I Been Pwned will not send you the exposed password. The FAQ is explicit that any ability to do that puts people at greater risk.
- If a password you still use is the thing you're afraid of, check that string on its own in Pwned Passwords. Is my password on the dark web? The email box will not answer that. Have I Been Pwned does not show the password that was stored beside the address. The password check is separate. The password is SHA-1 hashed, it is not stored next to an email address, and the search is anonymised before it is sent. A hit means that string has been seen, and how many times. It does not mean the service knows the string was yours. Stop using it.
A few results that look like errors are the service working as documented. An email in a paste, a Pastebin-style post, is not automatically a breach of a company. Pastes are often gone by the time you look; the FAQ says a new one is usually indexed within 40 seconds, and the paste itself is not kept. Some loads are flagged unverified, and some fabricated: aggregated or invented data that can still contain a real email address. Read the flag before you treat the row as "that company was hacked." A username that isn't an email address can belong to someone else who picked the same name. And plus-addressing, writing you+shop@example.com, shows up in about 0.03% of addresses in the system and is not supported, so the search does not treat the tagged address and the bare one as the same inbox.
On 22 October 2026 the FAQ listed 89 sensitive breaches, including Ashley Madison and a long list of adult and dating sites. The Genesis Market breach page's boilerplate listed 74. They can't both be the live total. A public search will not show a sensitive breach either way.
Genesis Market: logins that were actually for sale
Genesis Market is a case where the logins were offered for sale, and where the public record is good enough to see what a headline number leaves out. Police took it down on 4-5 April 2023 in an operation they called Operation Cookie Monster.
The US Justice Department, announcing the seizure on 5 April 2023, said that since March 2018 Genesis had offered data stolen from over 1.5 million computers, containing over 80 million account credentials. Buyers could search those credentials by location or by account type, and the market sold device fingerprints and browser cookies along with the passwords, so a buyer could look like the victim's own browser to the site they were logging into. Victim credentials from the investigation were given to Have I Been Pwned.
Eurojust's account, the same week, measures a different moment: at the takedown, the market was advertising credentials stolen from approximately 460,000 devices. The packages, which the operators called "bots," came from malware on those computers. Eurojust also says the market was reachable on the dark web and on the ordinary web. More than 100 arrests and more than 200 searches ran across 13 countries on 4-5 April. The dark web explainer is what that half of the storefront was. The clear-web half is why "go and look on an onion site" was never the whole map, even for this market.
Have I Been Pwned's own page for the breach calls "8M" an approximation, because many of the stolen accounts had no email address to load. It lists names, physical addresses, phone numbers, dates of birth, passwords, credit cards and card CVVs among the fields, with the caveat that not every person had every field. The breach was added on 5 April 2023, it is marked sensitive, and the page says it is not publicly searchable. To see whether your address is in it, you verify the inbox and look under Breaches, or you search a domain you control. Someone who only used the public box, including in April 2023 when the FBI was telling victims to go there, would not have been shown this row.
80 million credentials, 460,000 devices and 8 million email addresses are three different counts of one market. The question they leave you is whether this inbox is in the sensitive record. The public search will not say.
What to change, and in which order
The right order depends on which row you got.
An old company breach, on a computer that wasn't the one that leaked, is a password problem. If that password was unique and you have already replaced it, the remaining work is knowing the row exists. Have I Been Pwned will not drop the address from a breach because you changed the password afterwards. The fact that it was in the breach is what the FAQ calls an immutable historic fact. If the password was reused, change it on the email account first, then the bank, then everywhere else it was typed. Do that from a machine you are willing to type a new secret into.
A stealer log is a different order, because the computer may still be running the program that took the last batch. Infostealer malware is how that program packs the browser, and why a new password does not always close the stolen session. Eurojust's advice to Genesis victims was to run antivirus and let it remove the malware, and only then to change passwords, "unless you want the cybercriminals to get their hands on them." Have I Been Pwned's recommended action on the Genesis page says to change the password immediately. That is the right line for an old breach of a company's own database. It is the wrong first move when the source was malware on the PC in front of you. The service marks some loads as malware for this reason. Its example is data from the Emotet malware, given to it by the FBI and the Dutch NHTCU in April 2021, where the risk is that the person's own device was compromised.
On 25 February 2025 Troy Hunt described loading one stealer-log collection, ALIEN TXTBASE, published as files on Telegram: 23 billion rows, 493 million unique pairs of a website and an email address, and 284 million distinct email addresses. Passwords from that load went into Pwned Passwords, 244 million of them strings the service had never counted before. They are not handed back tied to the inbox. One channel's files are not the whole trade. They are large enough that "this email is absent from the famous breaches" is a weak all-clear.
A Social Security number, or the same kind of government ID outside the United States, is not something this email check can see. Have I Been Pwned does not take one. In the US, the step that does not wait on a scan is a credit freeze. The Federal Trade Commission says a freeze is free to place and to lift, that it does not affect your credit score, and that while it is on, nobody, including you, can open a new credit account in your name. You contact all three bureaus, Equifax, Experian and TransUnion. It lasts until you lift it. Lifting is for the moment a lender, an employer, a landlord or an insurer needs to look, and the FTC's advice is to lift it at the bureau that lender will use, then put it back. A freeze does not unwind a charge on a card you already hold. That call is to the bank.
A fraud alert is the weaker tool: you contact one bureau, it tells the other two, and lenders are asked to check it is you before opening a new account. An initial alert lasts one year and can be renewed. It does not stop a business from seeing the credit report. Use it if you need the file to stay visible and you want the phone call. Use the freeze if the goal is that new accounts cannot be opened. If accounts already have been, the FTC points you to IdentityTheft.gov, which is a recovery plan, not a scan.
The copy stays where it is
Changing the password makes the stolen secret useless on that account. It does not pull the old file back from whoever already has it, and an opt-out on Have I Been Pwned only stops that one site displaying the row. Paying for dark web monitoring buys another pass over a corpus, and an email when the next match appears. It does not buy a look inside a sale that was never shared, which is the third column in the table above. For a single inbox, the free notification, with the storage tradeoff already named, is that email. A company watching every address on its domain is a different product: Have I Been Pwned's domain search, which requires proof you control the domain. The stealer-log queries by domain sit on the paid tier Hunt describes in the same post. That is an organisation's problem, not a reason for one person to buy an identity-theft bundle.
If the email password and the bank password are still the same string, an old dump is enough. A scan does not have to catch a fresher copy. Bitwarden, or KeePassXC if you want the file on your own disk, is how you stop reusing them without keeping the list in your head. The privacy-tools page has the audits and the price.