iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No public service can prove that your information is currently listed on every criminal marketplace. The practical answer is to check your email addresses against known breach and malware-derived records, check saved passwords without disclosing them to an unknown site, verify any breach warning through the affected organisation’s official channels, and look for signs that an account or device has actually been used.
A match in a reputable breach database is evidence of past exposure in that database. It is not proof that the record is still for sale, that every stolen record has been found, or that an attacker can currently sign in. Conversely, a clean result is not proof that your data is safe.
What you can—and cannot—find out
Cybercrime marketplaces may offer usernames and passwords, remote-desktop access, identity documents, payment data or malware “stealer logs.” These markets are private, fragmented and short-lived. There is no public, universal search box that covers every criminal forum and confirms whether a particular person’s data is currently being sold.
Free tools Windows power users keep installed
One-click scans. No signup required.
The strongest evidence normally comes from one of four places:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- A known breach record that includes your email address.
- A password that appears in a reputable breached-password corpus.
- An official notice from an organisation confirming a breach and your involvement.
- Direct evidence of account or device misuse, such as an unfamiliar login or a changed recovery address.
Each type of evidence answers a different question. A breach database can show that information was exposed at some point. It cannot establish the current price, buyer, seller or status of a criminal listing. An account alert can show attempted or successful use, but it does not identify every place where copied data may exist.
What “cybercrime marketplace” means
Criminal markets are not one central service. Some sell lists of email addresses and passwords; others sell access to already-compromised computers, corporate remote desktops or identity records. Listings may be copied between forums, resold, removed or left stale after passwords are changed.
The FBI described the xDedic marketplace in a January 15, 2020 notice as a market for compromised computer credentials. The FBI and IRS estimated that it had listed more than 800,000 credentials. That historical figure demonstrates the scale such markets can reach; it is not a current count and does not provide a way to search for an individual’s record.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why a marketplace listing is hard to prove
- Many criminal sources are private, invite-only or taken offline.
- Publicly reported breach data covers only a subset of stolen data.
- The same record can be copied, reformatted or resold without a new breach.
- “For sale” claims in unsolicited messages may be fabricated to steal money or login details.
Use the checks that match the evidence you have
| Check | What it can establish | What it cannot establish | Privacy and timing |
|---|---|---|---|
| Have I Been Pwned email search | Your email appears in breach, paste, spam-list or malware-derived records known to the service; the result may show a breach name, date and exposed data categories. | It does not prove the data is currently being sold, that every breach is included or that your account is presently compromised. | Instant lookup; coverage is limited to records the service has obtained and processed. |
| Chrome Password Checkup | Saved credentials match known breached credentials in Google’s encrypted comparison list. | It does not identify every stolen password or inspect passwords you have not saved in the browser. | Google says credentials are encrypted before comparison and that it does not learn the usernames or passwords. |
| Have I Been Pwned Pwned Passwords | A password has appeared in breach data and should not be reused. | It does not connect the password to a person, email address or specific account. | Passwords are SHA-1 hashed, kept separate from personal data and searched in an anonymised way. |
| Official breach notice | The organisation confirms an incident and can explain what data and dates are involved. | It does not prove that a criminal marketplace currently has an active listing. | Quality depends on reaching the organisation through a trusted, independently verified channel. |
| Account and device review | Unusual logins, new devices, changed recovery settings or malware indicators can show active misuse. | A quiet account does not prove that copied data was never exposed. | Review immediately and continue monitoring after recovery. |
Step 1: Check every email address for known exposure
Search addresses separately
Use the official Have I Been Pwned service for each email address you use, including old addresses that still receive password-reset messages. Review the individual breach names, the dates displayed by the service and the categories of data reported, such as email addresses, passwords, phone numbers or physical addresses.
The service includes conventional breach data as well as pastes, spam lists and malware-derived records. A stealer log is particularly important: it is data collected by malware that captures an email address, password and the website where the credentials were entered. That points to a possible infected device, not just a company database incident.
Interpret a result correctly
- A match: treat the listed data categories as exposed and begin account recovery. The result is evidence of inclusion in that service’s dataset, not proof of a live marketplace sale.
- No match: treat it as “not found in this dataset.” Have I Been Pwned states that it contains only a small subset of all breached records; private or undetected breaches may be absent.
- Several matches: deal with the newest or most sensitive exposure first, then check whether the same password was reused elsewhere.
Do not infer that a breach date is the date criminals first accessed or last sold the data. Services often publish records after an incident has been investigated and processed.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 2: Check saved passwords without giving them to a stranger
Use Chrome Password Checkup
- Open Chrome’s Passwords and autofill settings.
- Select Google Password Manager.
- Choose Checkup.
- Review any compromised, reused or weak credentials and open the affected service through its known official website.
Google documents that Chrome encrypts credentials before comparing them with an encrypted list of known breached data. Google says it never learns your usernames or passwords during that comparison. The same checking function is available through passwords.google.com, where Google Password Manager can notify you when saved credentials are identified as compromised.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use the official Password Checkup page to change unsafe credentials. Do not follow a reset link in an unexpected email or text until you have independently confirmed that the message is genuine.
Use breached-password checking carefully
If you use the Pwned Passwords service, understand its purpose: it tests whether a password has appeared in breach data; it does not tell you which person or account used it. The documented design hashes passwords with SHA-1, keeps them separate from personal data and performs the search in an anonymised way.
A match means the secret has previously appeared in a data breach. Stop using that password anywhere, even if the account where you first created it has never shown suspicious activity. Never paste a live password into an unfamiliar “dark-web checker” or a form reached through an unsolicited alert.
Step 3: Verify a breach alert independently
Warning signs of a phishing notice
Messages claiming that your personal information is being sold may be designed to make you panic and disclose another password, pay a fake recovery fee or install malware. Be especially cautious when a message:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Uses urgent language or threatens immediate account closure.
- Links to a shortened, misspelled or unfamiliar domain.
- Requests your password, one-time code, identity document or cryptocurrency payment.
- Promises compensation, a “scan,” a refund or a dramatic reduction in risk if you act immediately.
Confirm through a trusted route
- Do not click the supplied link, open its attachment or call the number in the message.
- Type the organisation’s known web address yourself or use a trusted bookmark.
- Use the organisation’s published support number or official social channel to ask whether the incident and your involvement are real.
- Check the organisation’s security or incident page for the same notice, dates and affected data categories.
The UK National Cyber Security Centre also advises watching for follow-up messages about password resets, compensation, device scans or missed deliveries. A genuine incident can be followed by phishing that imitates the affected organisation, so verification remains necessary even when a breach itself is real.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 4: Look for signs that an account or device was used
Review account activity
For each important account, inspect sign-in history and security notifications. Look for new devices, unfamiliar locations or times, messages you did not send, newly created forwarding rules, and changes to the recovery email address or phone number. Check connected applications and revoke access you do not recognise.
Recognise a possible stealer-log incident
If a breach result identifies a stealer log, assume that malware may have copied credentials from your own device. Change passwords from a device you trust, not from the potentially infected computer or phone. Disconnect the suspect device from sensitive accounts, update its operating system and browser, and scan or remediate it with a reputable security tool. A scan can help stop further theft; it cannot recall data that criminals already copied.
After the device is clean, repeat the account review. Stealer malware may capture several services in one session, so changing only the account named in an alert can leave other credentials exposed.
Step 5: Recover accounts in the right order
- Secure your primary email first. Email is commonly used for password resets. Set a new, unique password and review its recovery methods, forwarding rules, active sessions and connected apps.
- Replace the exposed password everywhere. Search your password manager for the exact password or close variants. Do not merely add a character or change the final number; use a genuinely unique credential for every service.
- Sign out other sessions. Use each service’s “sign out of all devices” or session-management control after changing the password.
- Enable multifactor authentication. An authenticator app, passcode-based method or physical security token is preferable to password-only access. Where available, use a passkey or hardware security key.
- Check recovery channels again. Confirm that phone numbers, backup email addresses, authentication devices and recovery codes belong to you.
- Review transactions and messages. For financial, shopping and social accounts, inspect recent activity and report anything you did not authorise.
A USB/NFC FIDO2 security key is an optional physical MFA tool. It can reduce dependence on a password, but it does not determine whether your information appeared in a breach or marketplace.
Step 6: Respond to identity-data exposure
Password exposure and identity-document exposure require different actions. If a Social Security number, driver’s-license information or financial identity data is involved, use the FTC’s IdentityTheft.gov/databreach guidance.
- Obtain your free credit reports and check for accounts, inquiries or addresses you do not recognise.
- Place a fraud alert when you want creditors to take extra steps to verify applications.
- Consider a credit freeze when you do not expect to apply for new credit; it restricts access to your credit file until you lift it.
- Use any legitimate credit-monitoring or identity-theft service offered by the organisation involved, after confirming the offer through its official website.
- Report suspected identity theft and follow the recovery plan provided by the FTC.
Credit monitoring can alert you to certain changes; it cannot erase already copied information or prevent every form of fraud. Continue checking statements and account notices even after enrolling.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to judge the quality of an alert
| Evidence | Confidence about past exposure | Confidence about current misuse | Best next action |
|---|---|---|---|
| Official organisation notice with incident details | High for the categories and population the organisation confirms | Not established by the notice alone | Verify independently, then follow the organisation’s reset and identity-protection instructions. |
| Have I Been Pwned match | High that the address appears in that service’s collected record | Not established | Change affected and reused passwords; investigate the listed data category. |
| Pwned Passwords match | High that the password appeared in breach data | Not established | Retire the password everywhere and replace it with unique credentials. |
| Unsolicited “dark-web” email or text | Low until independently confirmed | Low until independently confirmed | Do not use its contact details; verify through the organisation’s known channels. |
| Unfamiliar login, recovery change or transaction | May indicate successful access | High for that specific account or service | Secure email, terminate sessions, enable MFA and contact the service’s official support. |
Common mistakes that make the situation worse
- Assuming “not found” means safe: no database has complete visibility into private, recent or undiscovered breaches.
- Testing a live password on an unknown site: the checker itself may collect the credential.
- Changing only one account: reused passwords expose every service that accepts the same secret.
- Following the alert’s link: a real breach can be used as the pretext for a second phishing attack.
- Ignoring the device: a stealer-log result can mean that new passwords will also be captured.
- Believing a marketplace screenshot proves current ownership: screenshots can be old, fabricated or copied from another incident.
- Paying a supposed rescuer: criminals may demand money while providing no deletion, recovery or notification service.
A practical response checklist
- Search every email address in Have I Been Pwned and record the breach names, dates and exposed categories.
- Run Chrome Password Checkup or the official Google Password Manager check for saved credentials.
- Retire every password that appears in breached data and every reused version of it.
- Secure the primary email account, terminate unknown sessions and enable MFA or a passkey.
- Inspect sign-in history, recovery settings, forwarding rules, connected apps and recent transactions.
- If a stealer log or suspicious device is involved, isolate and remediate the device and rotate credentials from a clean one.
- Independently verify every breach notice through the organisation’s known website or phone number.
- For Social Security, license or financial identity exposure, obtain credit reports and consider a fraud alert or freeze through official channels.
What a “clean” result really means
A clean email search means only that the address was not found in the records the service currently holds. A clean password check means the tested saved credentials did not match the known list at that time. Neither result proves that an account has never been attacked, that a private breach does not exist, or that malware has not captured a newer password.
The most reliable protection is therefore layered: use breach checks as evidence, verify alerts independently, watch account activity, keep each password unique, and require MFA for important services. This combination reduces the chance that an exposed secret can be reused, while giving you a way to detect and contain actual misuse.
Frequently asked questions
Can I search criminal marketplaces directly for my name?
There is no safe, comprehensive public search for all criminal markets. Attempting to access private forums can expose you to malware, scams and legal risk. Use reputable breach datasets and official incident notices instead.
If my password appears in a breach, does that mean someone can log in now?
Not necessarily. The password may be old, the service may require MFA, or the record may be incomplete. It must nevertheless be treated as unusable everywhere because attackers can test reused credentials automatically.
Will deleting an exposed email account remove stolen copies?
No. Closing an account can stop future access to that mailbox, but it cannot recall data already copied, reposted or sold. Secure other accounts that used the same address or password and continue monitoring for misuse.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFrequently Asked Questions
Can I search criminal marketplaces directly for my name?
There is no safe, comprehensive public search for all criminal markets. Use reputable breach datasets and official incident notices instead.
If my password appears in a breach, does that mean someone can log in now?
Not necessarily, but retire the password everywhere because attackers may test reused credentials automatically.
Will deleting an exposed email account remove stolen copies?
No. Closing an account cannot recall data already copied or reposted; secure related accounts and monitor for misuse.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
