How to Check If Your Email or Password Is on the Dark Web

By NorwegianSpark Editorial · Published July 13, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

The fastest way to check whether your email is on the dark web is free and takes about two minutes: enter the address at Have I Been Pwned and it lists every known data breach that address appeared in. To check a password, use a checker that never sends the password itself — Have I Been Pwned's Pwned Passwords, or our own Breach Radar, which hashes it in your browser and sends only a short prefix of the hash. What you should not do is go looking on the dark web yourself: there is nothing to find by hand, and the risk is all downside.

Step 1: check your email address

Have I Been Pwned was launched by security researcher Troy Hunt in 2013, after the Adobe breach, and describes itself as "a free service for people to assess risk in relation to their account being caught up in a breach". On 30 September 2026 its homepage counted 1,038 breached websites and 17,837,211,580 breached addresses. Type your address in and you get the list of breaches it appeared in, with dates and the kinds of data each one exposed.

Two limits are worth knowing, both stated in its own FAQ. Some breaches are flagged sensitive and are not publicly searchable — you only see them after verifying you own the address. And the database holds "but a small subset of all the records that have been breached", because many breaches are never released publicly. A clean result is good news, not a guarantee: in the site's own words, "absence of evidence is not evidence of absence".

Step 2: check your passwords, safely

Never type a real password into a website that asks you to "see if it has leaked" unless you know how it handles it. The safe design is called k-anonymity: your device hashes the password, sends only the first few characters of that hash, receives every leaked hash that starts the same way, and does the final comparison locally. The password — and even its full hash — never leaves your machine. Have I Been Pwned's Pwned Passwords works this way, and so does the password check in our Breach Radar.

If a password shows up, stop using it everywhere, not just on the site where you first used it. A password that has leaked once ends up in the lists that attackers try automatically against other services.

Step 3: understand what a hit means

Finding your email in a breach does not mean your account was hacked or that anyone is actively using your data — it means a service you used was compromised and your record was part of the dump. The risk depends entirely on what leaked:

Match your reaction to the data type rather than to the fright of seeing a red result.

Which free dark web checks still work in 2026

• Have I Been Pwned — free email and password checks, plus a free notification service that emails the address itself when it appears in a new breach (you cannot monitor someone else's address).
• Google's Dark Web Report is gone. Google discontinued it in February 2026, with scans stopping the month before, so if you relied on it you need a replacement.
• Vendor one-off scans — several security companies offer a free email scan, including NordPass's "Have I Been Hacked?" checker and breach look-ups from the major antivirus suites.

Step 4: decide whether you need ongoing monitoring

Free checks are a snapshot; the leaks keep coming. If you want to be told about the next exposure rather than remembering to look, that is what continuous monitoring is for — we weigh up whether it is worth paying for in what is dark web monitoring. Tools that combine the check with the fix are the most practical: NordPass scans your stored logins with its Data Breach Scanner and lets you rotate a weak password in the same app, NordVPN's Dark Web Monitor watches your email for new leaks, and an all-in-one suite such as Norton 360 with LifeLock adds ongoing dark-web and identity monitoring.

If the check turns something up

Do not stop at knowing — follow the specific steps in what to do if your data is on the dark web. The two habits that neutralise most of what these scans find are a password manager, so every account has a unique password and one leak cannot unlock the rest, and two-factor authentication, so a stolen password alone is not enough to get in. How the data got there in the first place is explained in how your personal data ends up on the dark web. If you would like to understand what the dark web actually is, our sister site covers it in VPNTex's guide to the dark web.

Check your email at Have I Been Pwned first, check passwords only with a k-anonymity tool, judge the result by what type of data leaked, and fix reused passwords straight away. If the free check keeps turning things up, the paid monitoring options are compared in our security tool shortlist. This is general guidance, not security advice for a specific situation.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore