How To Check If Your Email Has Been Sold On The Dark Web For Free

Your Email Is Probably Already Out There. Here's How to Find Out for Free.

A friend of mine got a call from her bank last year. Someone had tried to open a credit card in her name using an email address she hadn't touched in six years. An old Hotmail account from college. She'd completely forgotten it existed. The person trying to steal her identity hadn't.

That old account had been sitting in at least three data breaches — a gaming site, a coupon app, and a forum she signed up for once in 2011 and never visited again. Her email, password, and in one case her date of birth, had been packaged up and sold multiple times on dark web marketplaces. She had no idea until the fraud attempt.

This happens more than people realize, and the scary part isn't the big breach you hear about on the news. It's the small ones from sites you forgot you ever used.

Start Here: Have I Been Pwned

The single most useful free tool for this is Have I Been Pwned, built by security researcher Troy Hunt. You type in your email address, and it cross-references it against a database of over 13 billion compromised accounts pulled from known breaches.

It takes about four seconds. No account required. No email confirmation loop. Just type your address and see.

What you get back is a list of specific breaches — the name of the site, when it happened, and what data was exposed. Not vague categories. Actual specifics: "your password was exposed," "your phone number was exposed," "your physical address was exposed." That specificity matters because it tells you how bad each one actually was.

According to Have I Been Pwned, the site is run as a free public service and has been used to notify millions of people about their compromised credentials. It's regularly cited by government agencies and law enforcement as a legitimate resource.

Check every email address you've ever used. That includes the embarrassing one from high school, the one you made for a free trial, and the work address from a job you left four years ago. Old addresses don't stop being vulnerable just because you stopped logging in.

The Counterintuitive Part Most Articles Skip

Here's what almost no one tells you: finding your email in a breach database is not actually the emergency. The real emergency already happened — possibly years ago. The breach is in the past. What you're doing now is damage assessment.

This matters because people see a breach notification and panic about the wrong thing. They rush to change the password on the breached site, which is fine, but they don't check whether they used that same password anywhere else. That's where the actual damage gets done.

Attackers don't manually try your stolen credentials on one site. They use automated tools that test username/password combinations across hundreds of sites simultaneously — a technique called credential stuffing. According to CISA, credential stuffing is one of the most common causes of account takeovers, and it works precisely because people reuse passwords.

So if your email and password from a 2016 forum breach are sitting in a criminal's list, they've almost certainly already been tested against your bank, your email provider, and your Amazon account. The question isn't whether the breach happened. It's whether you've closed the doors it opened.

What to Actually Do After You Find a Breach

If Have I Been Pwned shows results, here's the order of operations:

First, identify which password was exposed. If you can't remember, assume it's one you've reused elsewhere. Change that password everywhere you've used it — not just on the breached site.

Second, check whether the breached service still exists. If it does, log in and delete your account. There's no reason to leave your data sitting on a platform that's already proven it can't protect it.

Third, turn on two-factor authentication on any account that matters — your email provider especially, since email is the master key to every other account. Even a basic SMS-based 2FA is better than nothing, though an authenticator app is significantly harder to bypass.

Attackers who acquire breached credentials often try password reset flows next, targeting security questions whose answers are frequently guessable from public social media profiles. Change your security questions on important accounts if the breach exposed personal data like your birth date or hometown.

Other Free Tools Worth Using

Google has a built-in password checkup at passwords.google.com that will flag any saved credentials that appear in known breaches. If you use Chrome and let it save passwords, this is worth running.

Firefox Monitor, at monitor.firefox.com, does essentially the same thing as Have I Been Pwned and actually pulls from the same underlying data. It's useful if you prefer a slightly more visual interface, and it offers breach alerts going forward.

Neither of these tools shows you the dark web marketplace listings themselves — they show you the breach source data. That's an important distinction. Services charging you $20/month to "scan the dark web" are mostly showing you the same breach datasets, wrapped in alarming language.

The Honest Limitation

These tools only show breaches that have been discovered and reported. Private sales between criminal actors, fresh breaches that haven't surfaced yet, and data from smaller regional leaks that never made it into public datasets — none of that shows up.

A clean result from Have I Been Pwned doesn't mean your data is safe. It means your data hasn't been found in any breach that's been publicly documented. Those are very different things. Treat it as useful information, not a clean bill of health.

Sources:

Have I Been Pwned
CISA

Your Instagram Was Logged In From Another Country — What To Do In The Next 10 Minutes

You're making coffee. Your phone buzzes. Instagram just sent you a security alert — someone logged into your account from a city you've never been to. Maybe it's Kyiv. Maybe it's Jakarta. Your stomach drops.

This is not a drill, and it's not always a false alarm. Here's exactly what to do before that coffee finishes brewing.

First: Don't Close That Alert

The instinct is to tap away and tell yourself it's probably nothing. Resist that. That notification is your only real-time window into what's happening. Screenshot it before you do anything else — you'll want the timestamp, the location, and the device type if you ever need to report this.

Now open Instagram. Go to Settings → Security → Login Activity. You'll see every device currently logged in and recent sessions. If something looks wrong, you'll know immediately.

Change Your Password Right Now — But Not the Way You Think

Yes, change your password. But the mistake most people make is changing it to something only slightly different. "fluffy2023" becomes "fluffy2024." That does almost nothing if your credentials were harvested in a data breach, because attackers often run automated scripts that try variations.

Use a random password generated by a password manager — something like Tr7#mXqL29!vB. Ugly. Unmemorable. Perfect. According to NIST's digital identity guidelines, passwords should be long and random rather than complex-but-predictable patterns humans tend to reuse.

After changing it, Instagram will automatically log out other sessions. That's the actual fix happening in real time.

Here's the Thing Most Articles Won't Tell You

The login from another country might not mean someone broke in. It might mean your password is already floating around on a breach database — and the attacker logged in passively weeks ago and you're only now getting the alert.

Check your email address at Have I Been Pwned (haveibeenpwned.com). If your email shows up in a breach from two years ago, your password from that time has been circulating ever since. The "foreign login" is often just the moment someone finally tried it.

This matters because it changes your response. You're not just locking one door — you're realizing you've had a window open for months.

Turn On Two-Factor Authentication Before You Do Anything Else

Actually, do this while you're changing the password. Go to Settings → Security → Two-Factor Authentication. Use an authenticator app like Google Authenticator or Authy — not SMS.

Why not SMS? Because SIM-swapping attacks are genuinely common. According to Krebs on Security, attackers routinely convince phone carriers to transfer a victim's number to a new SIM, intercepting every text message including 2FA codes. An authenticator app generates codes locally on your device, so stealing your phone number doesn't help them.

This one step closes the most common attack vector completely.

Check What Apps Have Access to Your Account

Go to Settings → Security → Apps and Websites. There's often a graveyard of third-party apps you connected once and forgot — quiz apps, scheduling tools, photo editors, random contests you entered.

Any of these can be a backdoor. If an app you authorized three years ago was later compromised, attackers can access your Instagram through that app's permissions without ever needing your password. Revoke anything you don't recognize or actively use.

Review Your Linked Email Account Too

This step gets skipped constantly. Your Instagram is only as secure as the email address attached to it. If someone controls your email, they can request a password reset and walk right back in — regardless of what password you just set.

Log into that email account. Check for forwarding rules you didn't create (attackers set these up silently to monitor your inbox). Check recent login activity there too. According to CISA's guidance on account compromise, securing the recovery email is often the step that makes or breaks whether an account takeover succeeds or fails.

If It's Too Late and You're Locked Out

If you can't get in, go to instagram.com/hacked — Instagram's official recovery flow. Don't use random "account recovery" services you find through Google. Many of them are scams built specifically to harvest desperate people's information a second time.

The legitimate recovery process involves confirming your identity through your phone number, email, or a video selfie Instagram compares to your photos. It's slow. It's frustrating. It works.

What to Do After the Crisis

Once you're back in control, do a quiet audit. Look at your DMs — attackers often use compromised accounts to send phishing links to your followers before you notice anything. If you see messages you didn't send, warn the people who received them.

Also check your Stories and Posts. Some attackers post nothing for weeks and use the account to silently harvest your followers' contact information or run influence campaigns. The goal isn't always obvious damage.

The Honest Caveat

Here's what no one says outright: if an attacker had full access to your account for days or weeks before you were alerted, the damage to your contacts is already done. You can secure your account completely — new password, 2FA, revoked apps, locked recovery email — and your followers may have already clicked a phishing link they received from "you."

You can protect yourself going forward. You can't fully undo what already happened while you weren't looking. That's the real cost of a delayed response, and why acting in the first ten minutes matters more than any single step in this article.

Sources:

NIST (National Institute of Standards and Technology)
Krebs on Security
CISA (Cybersecurity and Infrastructure Security Agency)
Have I Been Pwned

Why Strong Passwords Are Not Enough Anymore (And What Actually Works)

Your Password Was Never the Problem

You're sitting at your desk when an email arrives: "We noticed unusual activity on your account." Your stomach drops. You think back — you used a strong password. Fourteen characters, mixed case, a symbol or two. You followed the rules. So how did this happen?

Here's the thing nobody wants to admit: the rules were always incomplete.

The Lock Was Fine. The Door Frame Was Rotten.

When your password gets compromised, it's rarely because someone sat there guessing it. Modern attacks don't work that way. What actually happened is more likely one of these three scenarios — and none of them care how strong your password is.

First, the site you used got breached and stored your password poorly. Your "strong" password got dumped into a database alongside 300 million others and sold for $10 on a Telegram channel. According to Have I Been Pwned, over 13 billion accounts have been exposed in data breaches to date. Your password strength is irrelevant when the vault itself gets stolen.

Second, you reused that password somewhere. Even once. Even years ago. Attackers run "credential stuffing" attacks — they take leaked username/password pairs and automatically try them across Netflix, banks, email providers. The automation is industrial-scale. One breach from 2019 can unlock your account today.

Third — and this one stings — you got phished. Not the obvious Nigerian prince kind. The kind where you got a convincing email, clicked a link, and typed your password into a site that looked exactly like your bank. Your password was correct. You handed it over yourself.

What "Strong" Actually Buys You (Less Than You Think)

Password strength matters in exactly one scenario: someone is directly attacking your specific account by guessing. This is called a brute-force attack, and it's actually one of the rarer threats targeting regular people. Banks rate-limit login attempts. Most modern services lock accounts after a few failures.

The counterintuitive truth here is that password length beats password complexity — and a passphrase you can remember is more secure than a random string you'll forget and reuse. NIST's current guidelines explicitly moved away from forcing complexity (the @symbols and capital letters game) in favor of longer, memorable passwords. The old rules weren't based on how attacks actually work. They were based on how difficult it is for a human to memorize characters.

A 20-character phrase like coffee-mug-tuesday-lamp is mathematically stronger than P@ssw0rd!2 and you'll never need to write it on a sticky note.

But even that passphrase won't save you from the scenarios above.

What Actually Works

Multi-factor authentication (MFA) is the single most effective change you can make. Not because it's unbreakable — it isn't — but because it raises the cost of attacking you high enough that most attackers move on to easier targets. According to CISA, enabling MFA makes you 99% less likely to be compromised through credential-based attacks. That number is worth sitting with.

Not all MFA is equal, though. Here's where most articles fail you by treating it as one thing:

SMS codes (text messages) — Better than nothing, but vulnerable to SIM-swapping, where an attacker convinces your carrier to transfer your number to their phone. If you're a high-value target, this matters.
Authenticator apps (Google Authenticator, Authy, similar) — Significantly better. The code lives on your device and rotates every 30 seconds. Use this as your default.
Hardware security keys (YubiKey, similar) — The strongest option. Physical device, phishing-resistant by design. Overkill for most people, essential if you work in finance, journalism, or handle sensitive systems.

Start with an authenticator app on your most important accounts: email first (it's the master key to everything else), then banking, then anything tied to your credit card.

The Password Manager Question

You've heard this advice before and probably ignored it. Here's why you shouldn't.

A password manager doesn't just store passwords — it makes you incapable of reusing them, because it generates unique 20-character strings for every site. You don't know what your Netflix password is. Neither does anyone who steals your LinkedIn credentials. The credential stuffing attack I mentioned earlier dies completely.

Bitwarden is free, open-source, and audited. 1Password costs a few dollars a month. Either one changes your threat profile more than any amount of password strength advice.

The one friction point worth acknowledging: your password manager account itself becomes the highest-value target. Protect it with a very long master passphrase and a hardware key or authenticator app. If that account falls, everything falls. So don't treat it casually.

The Thing That's Actually Hunting You

Most people imagine hackers as individuals targeting them specifically. The reality is automated and impersonal. According to Krebs on Security, credential stuffing operations run continuously, testing millions of login combinations per hour across hundreds of services simultaneously. You're not being hunted — you're being processed.

That reframe matters because it changes what you defend against. You're not trying to outsmart a clever adversary. You're trying to be slightly more annoying than the next person in the queue. MFA and unique passwords accomplish that. An attacker hitting a wall on your account doesn't sit down to work harder — the script moves to the next entry in the list.

This is actually good news. The bar to being "secure enough" for most people is not as high as the security industry makes it seem. You don't need to be perfect. You need to be marginally harder to compromise than the millions of people who are still reusing Summer2022!.

One Honest Caveat

Everything above assumes the threat is remote and automated, which covers the vast majority of cases for regular people. It doesn't protect you if someone with access to your physical device, your workplace network, or your personal life decides to target you specifically. Sophisticated phishing — a well-researched, personalized email that references your real colleagues and projects — can bypass even good habits.

There's no technical solution to the moment when you're distracted, tired, and a convincing message catches you off guard. Security awareness matters, and it's not a solved problem. These tools reduce your exposure dramatically. They don't eliminate it.

Start with MFA on your email. Then a password manager. Then expand from there. That sequence, done this week, will do more for your security than anything else you could read about it.

Sources:

Have I Been Pwned
CISA (Cybersecurity and Infrastructure Security Agency)
NIST (National Institute of Standards and Technology)
Krebs on Security