Quick answer
Most services sold as dark web monitoring search the same aggregated breach datasets that any breach checker searches. Some also collect material from closed forums and marketplaces. Either way, the finding is "this identifier appears in data we hold" — which is useful — and the absence of a finding proves very little, because no service can see everywhere. It is a reasonable early-warning signal and a poor substitute for unique passwords and multi-factor authentication.
What the phrase usually means in practice
"Dark web" refers to sites reachable only through anonymising networks such as Tor. Some stolen data genuinely is traded there.
But when a product offers dark web monitoring, what usually sits behind it is one or more of:
- Aggregated breach datasets. Collections assembled from published breaches. These are the bulk of nearly every service in this category, and they are not on the dark web in any meaningful sense — many circulate on the ordinary web.
- Combolists. Files of address-and-password pairs assembled from many breaches specifically to be used for credential stuffing.
- Paste sites and public dumps. Ordinary web, publicly reachable.
- Closed forums and marketplaces. This is the part that genuinely justifies the name — and it is the smallest and hardest part.
- Stealer logs. Output from information-stealing malware on infected devices, containing saved credentials and session data. Increasingly significant and quite different in character from a company breach.
The proportions matter. If a service's coverage is 95% aggregated breach data, calling it dark web monitoring is a naming choice, not a capability claim.
What it can actually tell you
Within its coverage, a service like this can tell you real and useful things:
- An identifier of yours appears in a dataset it holds.
- Which dataset, and often roughly when it was published.
- Which categories of data that record included.
- Sometimes, that a credential pair including your address is circulating — the specific condition that makes credential stuffing possible.
That is genuinely actionable. If a password of yours is in a circulating list, changing it everywhere it was used is a concrete step with a concrete effect.
What it cannot tell you
This is the part vendors are quiet about, and it is most of the value of understanding the category.
It cannot prove you are safe. A clean report means nothing was found in the data that service can see. It cannot distinguish between "you were never exposed" and "you were exposed in something we do not have". No service has a complete view, and no service can know the size of its own blind spot.
It cannot see private transactions. Data sold directly between two parties, or held by an attacker who has not released it, is invisible to everyone until it circulates. The gap between a breach happening and it appearing in any dataset is routinely months or years.
It cannot tell you whether anyone used the data. Presence in a list is not evidence of use, and absence of use is not evidence of safety. That question is answered by your account activity, not by breach data.
It cannot remove anything. Any service promising removal or deletion from dark web sources is selling something that cannot be delivered. Once a dataset has circulated it exists in copies nobody controls.
It cannot cover everything, and coverage is not comparable. Two services will return different results for the same address because they hold different data. Neither is wrong; there is no complete set to be measured against. This is also why a result from one service does not falsify a nil result from another.
What Compromised does, and does not do
Being specific, because the whole point of this article is that vague capability language is the problem:
Compromised runs point-in-time searches against a configured breach intelligence provider. You submit an identifier, the server queries the provider, and you get what that provider reports at that moment.
It does not crawl dark web marketplaces or forums, and it does not operate an independent comprehensive breach corpus. It cannot establish any provider's total coverage, and it does not claim to. It has no continuous monitoring, no saved alerting and no domain-wide scanning.
A nil result is therefore reported as "nothing was found in the data checked" rather than as an all-clear, which is the only accurate way to phrase it. You can check an identifier against known breach data, and how it works documents what happens to the value you submit.
Is it worth paying for?
A fair way to decide, rather than a recommendation either way.
It is worth more if:
- You have accounts you cannot easily inventory, and a notification would prompt you to act on one.
- You are responsible for other people's accounts — an administrator, or a small business owner.
- You know you have historic password reuse you have not finished cleaning up.
- Government identifiers or financial data have already been exposed once.
It is worth less if:
- Every password you use is unique and generated by a password manager. In that case a new breach exposes one account, and you would learn about it from the service's own notification.
- Multi-factor authentication is on everything that matters.
- You would not actually change behaviour on receiving an alert. An unread alert has no value.
The uncomfortable version: monitoring is a detective control, and detective controls are worth most where preventive controls are weakest. If your preventive controls are good, the marginal value is small. If they are not, fixing them beats subscribing to be told about it.
Questions worth asking any provider
Before paying for anything in this category:
- What sources do you actually cover? A refusal to answer beyond "the dark web" is itself an answer.
- Do you tell me which dataset a finding came from? A finding with no provenance is not actionable.
- Do you show me the result, or hold it back until I subscribe? A checker that reports a match and then requires payment to say anything more is monetising alarm.
- Do you claim removal? If so, the claim is false, and it tells you what else to discount.
- What happens to what I search? Particularly for passwords. How to judge a breach checker sets out the four questions in detail.
Where this sits
Dark web monitoring, breach exposure checking and identity theft protection get sold as if they were the same thing. They are not:
- Breach exposure checking answers "is this identifier in known leaked data?"
- Dark web monitoring is usually the same question with broader claimed sources.
- Identity theft protection watches credit files and financial account activity, and often bundles insurance and restoration. It answers a completely different question. See breach checks versus identity theft protection.
For the whole picture, the breach exposure guide is the place to start, and how often any of this is worth repeating covers cadence.
Frequently asked questions
My bank says my data was found on the dark web. Is that serious?
It means an identifier of yours appeared in data their provider holds. Ask which data was involved — an email address alone is mild; a password or a government identifier is not. The alert itself does not tell you anyone has used anything.
Why does one service find my address and another does not?
Because they hold different datasets. There is no complete corpus, so differing results are expected rather than a sign that one is broken.
Should I use a free checker or a paid monitoring service?
A free point-in-time check answers "am I in known breach data?" for nothing. A paid service adds re-checking on a schedule and notifications. Pay for the second only if the notification would change what you do.
Can I ask for my data to be taken down?
No. Deletion rights against a company that holds your data are a real and separate thing, and worth using. They do not reach copies already circulating in leaked datasets.