There is no public, universal search that can prove your email, password or identity record is currently listed on every criminal marketplace. The reliable approach is layered: check your email addresses against known breach data, test saved passwords through a service with a documented privacy design, independently verify any alert, and then look for signs that an account or device was actually misused.
A positive breach result is evidence that particular data appeared in a known dataset; it is not proof that the data is still for sale. A clean result is also limited evidence because many breaches remain private, unknown or absent from any one service. Treat every result as a prompt for specific defensive actions rather than as a complete safety certificate.
As an Amazon Associate I earn from qualifying purchases.
What a “cybercrime marketplace” check can—and cannot—tell you
Criminal markets trade different kinds of access and information: usernames and passwords, remote-desktop credentials, stolen browser sessions and identity records. The FBI described the xDedic marketplace in a January 15, 2020 investigation notice and said the FBI and IRS estimated that it had listed more than 800,000 credentials for sale. That historical figure demonstrates the market’s existence; it is not a current count and does not provide a public search tool for an individual.
Recommended Free Tools
Listings can move between private forums, invitation-only channels, malware operators and short-lived storefronts. A data broker, breach-notification service or security researcher may see one collection while missing another. For that reason, no consumer service can honestly promise to search every criminal venue in real time or prove that a record is not being traded.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use these distinctions when interpreting a result:
- Known exposure: your email address, password hash or other identifier appears in a dataset that a service has obtained and classified.
- Current sale: a specific criminal listing is active now. Ordinary public checkers generally cannot establish this.
- Account compromise: someone has used your account, changed its settings or obtained access. This requires checking account activity, not just a breach database.
- Device compromise: malware on your computer or phone captured credentials as you entered them. This can happen even when the company you used was never breached.
The most useful outcome is therefore a risk decision: which credentials to replace, whether to secure an email account first, whether a device needs investigation, and whether identity or credit protections are warranted.
Step 1: Check every email address against known breaches
Use Have I Been Pwned as an exposure lookup
Run each address you use—personal, work, old addresses and addresses used for shopping or forums—through Have I Been Pwned (HIBP). Review the breach names, dates shown by the service and the categories of information exposed. HIBP includes conventional company breaches, public pastes, spam lists and malware-derived records.
The categories matter. An incident exposing only an email address is different from one exposing a password, authentication token, phone number or physical address. Make a private note of which address and which categories appear; do not post the result publicly.
Understand HIBP’s limits
HIBP states that its database is only a subset of all breached records. Many incidents remain private, are not detected, or have not been added to the service. A “not found” result therefore means only that the address was not present in the datasets HIBP currently knows about. It does not prove that the address was never compromised, that no criminal has it, or that every account using it is safe.
Conversely, a positive result does not show that someone is currently selling your record. It shows that the address or associated data appeared in a known collection. Use the exposure date and data categories to decide what to rotate, while continuing to watch the account for misuse.
Recognize malware-derived or “stealer log” records
HIBP describes stealer logs as records collected by malware that captures email addresses, passwords and the websites where those credentials were entered. A stealer-log hit changes the response: the possible source is an infected device, not only a company database. Assume credentials entered on that device may be exposed, investigate the device with a trusted security tool, and change passwords from a clean device.
Step 2: Check saved passwords without giving a live secret to a stranger
Run Chrome Password Checkup
In Chrome, open Passwords and autofill → Google Password Manager → Checkup. The check reviews saved credentials against an encrypted list of known breached data. Google documents that credentials are encrypted before comparison and that Google never learns the usernames or passwords during this process.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Google Password Manager also offers Password Checkup at passwords.google.com. It can notify you when a saved password is compromised and provides a route to change unsafe passwords through the official password-management interface. Use the address you type yourself or a trusted bookmark rather than a link in an unexpected message.
Interpret a Pwned Passwords match correctly
HIBP’s Pwned Passwords service is designed to avoid tying a password to a person or account. Passwords are SHA-1 hashed, kept separate from personal data and searched in an anonymised way. If a password is found, it means that secret has previously appeared in breach data; stop using it anywhere, even if the account where you used it has not produced an alert. The service does not tell HIBP which person owns the password or which account you had in mind.
Never paste a current password into an unfamiliar “dark-web checker.” A site that demands the raw secret can collect it directly, and a convincing result may be fabricated to make you click a recovery link. Use a password manager’s built-in check or a service whose hashing and privacy design are clearly documented.
Compare the main checks
| Check | What it can establish | Privacy and coverage | What it cannot establish |
|---|---|---|---|
| Email lookup in HIBP | The address appears in breach, paste, spam-list or malware-derived datasets known to HIBP. | Useful for known exposure; coverage is incomplete and varies by incident. | It cannot prove a current criminal listing or that a clean result means safety. |
| HIBP Pwned Passwords | The password has appeared in breach data and should no longer be used. | Uses hashed, anonymised searching and does not link the password to your identity. | It does not identify your account, the source of your use or a current sale. |
| Chrome Password Checkup | A saved username/password pair matches known breached data or has another security warning. | Chrome encrypts credentials before comparing them with an encrypted list; Google says it does not learn the credentials. | It covers saved credentials and known data, not every account, device or marketplace. |
Step 3: Verify a breach alert independently
Unsolicited messages saying that your data is “on the dark web,” “for sale” or available for immediate recovery are common phishing hooks. The Federal Trade Commission warns that such messages may be designed to make you click, call a fake support number or disclose a password, payment detail or identity document. The UK National Cyber Security Centre gives similar advice for unexpected follow-up messages after a breach.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Do not use the message’s link, QR code, phone number or attachment. Leave the message open only long enough to record the claimed organisation and date.
- Reach the organisation independently. Type the known web address yourself, use a trusted bookmark or find the organisation’s published support number. Do not rely on contact details supplied in the alert.
- Ask whether an incident occurred and whether your account was included. A legitimate organisation can usually explain the affected service, time period and data categories without asking for your existing password.
- Sign in through the normal account portal. Check for an official notice, security-center message or forced reset. If the organisation has no record of the incident, treat the original alert as suspicious.
- Expect secondary lures. NCSC warns that criminals may follow a breach story with messages about password resets, compensation, device scans or missed deliveries. Verify every new message separately.
An official notice is stronger evidence than an unsolicited “monitoring” email, but it still does not prove that a criminal marketplace currently lists your record. It tells you which organisation believes your data was involved and what protections it offers.
Step 4: Look for signs that an account or device was used
Review account activity and recovery settings
For each important account, open the provider’s security or activity page and look for:
- Sign-ins from an unfamiliar location, device or time.
- New devices, browser sessions or app authorisations you do not recognise.
- A changed recovery email address, phone number or authenticator method.
- Messages, posts, purchases or password-reset requests you did not initiate.
- Rules or forwarding addresses added to an email account.
Capture the date and device information for anything suspicious, then use the provider’s “sign out of all sessions” or equivalent control after you regain control. Do not delete evidence before recording it if you may need to report fraud.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Recognize a possible stealer infection
A stealer-log record can indicate malware on a computer or phone. Warning signs include unexplained browser extensions, security tools being disabled, repeated account takeovers after password changes, unfamiliar processes or a sudden wave of logins from different services. The absence of these signs does not rule out malware.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If you suspect an infected device, disconnect it from networks where practical, avoid entering new passwords on it, and scan or investigate it with a trusted security tool. Recover accounts and rotate credentials from a clean device. A scan may stop future theft, but it cannot recall information that malware already copied.
Step 5: Recover accounts in the order that limits further damage
- Secure your primary email account first. Email is commonly used for password resets, so an attacker controlling it can retake other accounts after you change them. Change the email password from a clean device, review recovery methods and terminate unknown sessions.
- Replace every reused or exposed password. Start with banking, payment, cloud storage, work, social and shopping accounts, then continue through less important services. Give every account a unique, long password generated or stored by a reputable password manager.
- Enable multi-factor authentication. An authenticator app, passcode or physical token adds a second factor beyond the password. Prefer a passkey or a FIDO2 hardware security key—such as a USB/NFC security key—where the service supports it. A security key strengthens future logins; it does not reveal whether your data appeared on a marketplace.
- Recheck recovery channels. Remove unknown phone numbers, email addresses, devices, app passwords and third-party connections. Confirm that backup codes are newly generated and stored privately.
- Watch for delayed misuse. Keep reviewing sign-in alerts, statements and password-manager warnings. Criminals may test a credential weeks or months after the original breach.
Do not change only the account named in an alert if you reused that password elsewhere. The same secret should be considered unsafe everywhere it was used.
Step 6: Respond to Social Security, driver’s-license or financial identity exposure
This step is primarily for people in the United States. If an incident involved a Social Security number, driver’s-license information or financial identity data, the FTC directs consumers to IdentityTheft.gov/databreach for tailored recovery guidance.
- Obtain your free credit reports and inspect them for accounts, inquiries or addresses you do not recognise.
- Place a fraud alert when you want creditors to take extra steps to verify your identity before opening new credit.
- Consider a credit freeze when you want to block most new-credit applications until you lift the freeze.
- Use legitimate credit-monitoring or identity-theft assistance offered by the organisation involved, checking the offer through an independently verified channel.
- Contact banks, card issuers and government agencies through numbers printed on statements or official websites, not through the breach message.
Credit monitoring can alert you to some changes, but it cannot prevent every form of identity misuse and does not remove data already copied. Keep records of notices, reports, claim numbers and the dates you placed alerts or freezes.
Choose a check by coverage, privacy and urgency
| Your question | Best first action | Why |
|---|---|---|
| Has this email address appeared in a known breach? | Run the address through HIBP. | It aggregates known breaches, pastes, spam lists and some malware-derived records. |
| Has this password appeared in breach data? | Use Chrome Password Checkup or HIBP’s documented Pwned Passwords search. | You can check without handing a raw password to an unknown operator; a match means the password must be retired. |
| Is an unexpected alert genuine? | Contact the alleged organisation through an independently found official channel. | Message links and phone numbers may belong to phishers. |
| Could my device have leaked credentials? | Investigate for stealer malware and rotate credentials from a clean device. | Malware-derived records can come from your own device rather than a breached company. |
| Could my identity be used for new credit? | Use IdentityTheft.gov/databreach, review credit reports and consider a fraud alert or freeze. | These measures address identity and credit risk that password checkers do not cover. |
The trade-offs are straightforward: an instant lookup is quick but limited to known data; a future notification can catch later disclosures but cannot undo an earlier compromise; an official breach notice is stronger evidence than an unsolicited message; and password replacement, MFA, device recovery and credit protection address different parts of the problem.
Common mistakes and how to correct them
“The checker found nothing, so I am safe.”
A clean result only means that the particular service did not find your address or saved credential in its current data. Keep unique passwords, MFA and account-activity reviews in place.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
“The alert says my data is for sale, so I should pay immediately.”
Do not pay or provide identity documents until the organisation and incident are independently verified. Criminals use urgency, compensation claims and “removal” promises to collect more information.
“I changed one password, so the breach is fixed.”
Change every account that used the exposed secret, beginning with email. Otherwise an attacker can use credential stuffing against another service.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute“A password checker needs my raw password.”
Stop and leave the site. Use a documented password-manager check or an anonymised, hash-based service. A raw password submitted to an unknown checker is an additional compromise.
“The breach was years ago, so it no longer matters.”
Old credentials remain useful when people reuse them. Replace them, revoke old sessions and monitor the account even when the incident date is long past.
“A security scan deleted the stolen data.”
Scanning can help remove or contain malware, but it cannot recall copies already collected. Complete both device remediation and credential recovery.
A practical one-hour response checklist
- List every email address and important service you use.
- Check each address in HIBP and record breach dates and exposed categories privately.
- Run Chrome Password Checkup and retire every flagged or reused password.
- Secure the primary email account, review sessions and recovery details, then enable MFA or a passkey.
- Verify any alert through the organisation’s independently found website or phone number.
- Inspect account activity for unfamiliar devices, locations, messages and recovery changes.
- If a stealer log or suspicious device is possible, stop logging in on that device and investigate it from a clean one.
- If Social Security, driver’s-license or financial identity data is involved, follow IdentityTheft.gov/databreach, review credit reports and decide on a fraud alert or freeze.
- Save official notices and dates so you can distinguish a verified incident from later phishing attempts.
The goal is not to obtain an impossible guarantee that your information is absent from every criminal market. It is to turn the evidence available—known datasets, verified notices and account or device signals—into concrete protection before an exposed credential can be reused.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
