Credential leak monitoring for your company domains
Get alerted when leaked credentials tied to your domains or email addresses appear, see which service each one opens, and act before someone else does.
Create a free account to start investigating.
A monitored address appears in a leak
Review the context before deciding what to do next.
Investigate the exposed records, with the data to act.
File lines, not a count of unique accounts.
UpdatedPlaintext passwords, with their account context
Inspect the exposed password alongside the account and, for stealer logs, its service URL. When the source includes plaintext, that detail helps your team scope password resets and investigate exposed access.
Compare plans for plaintext access and included unlock points.
Stealer logs
Connect a captured login to its service URL, username and password to understand which access is exposed.
url:user:passCombolists
Find email/password and username/password pairs, including records without a service URL.
email:passuser:passRaw leak files
Search the text of leaked files, database dumps and unstructured records beyond normalized credential fields.
Dark web forums
Search indexed forum posts for mentions of your organization and examine the discussion's source context.
Get notified via Email, Slack, Discord, Telegram or Webhook when new exposed credentials match your monitored domains or email addresses.
Leaked credentials rarely come from your own servers.
Most compromised credentials are captured on an infected device or reused from another service, then circulate in stealer logs and combolists. Your own logs show nothing. Credential leak monitoring watches for your domains and addresses in that data and tells you which accounts are exposed, and where they log in.
Monitor the domain, then read each match with its service URL.
How credential leak monitoring works in LeakRadar
- 01
Add what you want to watch
Sign in and create a monitor for a company domain or for specific email addresses.
- 02
Get alerted on new matches
Get notified via Email, Slack, Discord, Telegram or Webhook when new exposed credentials match your monitored domains or email addresses.
- 03
Investigate and respond
Open the match to see the account, its service URL and, when the source contains it, the plaintext password. Then reset the affected access in your own identity systems.
Credential leak monitoring, in practice
What is credential leak monitoring?
It is the continuous search for usernames and passwords tied to your organization in data that circulates after infections and breaches: stealer logs, combolists and leaked files. The goal is to learn about an exposed account before it is used.
Leaked, compromised or exposed credentials?
The three terms describe the same thing: a login and a password that someone outside your organization can read. What changes the response is the context: which service the credentials open, how recent the record is, and whether the password is still in use.
Where do compromised credentials come from?
From infostealer malware that copies saved logins from an infected device, from lists of email and password pairs compiled from older breaches, and from database dumps. Stealer logs are often the most useful to act on, because they name the service.
What should you do when an alert arrives?
Check that the account and the service are in your scope, reset the credentials, revoke active sessions and review access logs. Apply MFA to reduce the risk of password reuse. A match alone does not prove that your servers were breached.
What you can work with
Access that fits your work
Start with a free account, then choose the plan that fits your datasets, monitoring, exports and team.
Compare plansEmployees, third parties and customers
Domain matches are sorted by who the account belongs to, so each team reviews the accounts in its own scope.
The service behind each credential
Stealer-log records keep the URL where the credentials were captured, so you know which access is exposed.
Alerts, exports and API
Alerts via Email, Slack, Discord, Telegram or Webhook, exports that run in the background, and a REST API with a Python client.
Before you get started
Is credential leak monitoring the same as dark web monitoring?
Dark web monitoring is a broader label that often covers forums and marketplaces. LeakRadar monitoring focuses on exposed credentials that match your domains or email addresses. Dark web forum posts are a separate search, available according to your plan.
Which datasets are monitored?
Monitoring covers new exposed credentials that match a monitored domain or email address. The datasets, the number of monitored assets and the alert channels depend on your plan.
Can I see the leaked password?
LeakRadar can reveal the plaintext password when the source contains it, subject to your plan, unlocking and display preferences. Credentials stay masked until you unlock them.
Can I monitor several domains?
Yes, within your plan's monitoring capacity. Configure the domains in your member account and choose the relevant alert channels.
What can a free account monitor?
The free account can monitor its signup email in Stealer Logs, with notifications sent to that address. Additional assets, datasets and notification channels depend on a paid plan.
Does a match mean we were breached?
No. A credential associated with your domain may come from a compromised device or another service. Examine its context before drawing conclusions.