Google’s dark web report scanned for new breaches until 15 January 2026 and was switched off on 16 February 2026, according to Google’s own help page. If you relied on it, you now need another way to see whether your details have leaked. On 21 October 2026 we ran two tools on test inputs: Have I Been Pwned and our own Atlas Domain Scanner. We show results only for the tools we ran.
What Google Actually Shut Down
Google’s help page on the change says the report was meant to scan the dark web for your personal information. Scans for new dark web breaches stopped on 15 January 2026. On 16 February 2026 the report became unavailable, and Google said all data tied to it would be deleted that day. Only consumer Google Accounts could use it. Workspace and supervised accounts could not.
Google gives one reason: feedback showed the report did not offer helpful next steps. It now points people to Security Checkup, passkeys, Password Checkup and a tool called Results about you. None of these is a dark web scan, so there is no like-for-like swap. Below is what two tools did when we ran them.
How We Ran the Tests
We used no real person’s data. The inputs were test@example.com, the domain example.com and a short password-hash prefix. We used curl on public pages and free endpoints, and one Atlas scan in a normal browser. We created no accounts, paid for nothing and submitted no forms on third-party sites. We did not run tools that need a sign-in or that block scripts, and we show no results for them.
- Date
- 21 October 2026
- Inputs
- test@example.com, example.com, one password-hash prefix
- Ran
- Have I Been Pwned (API and free endpoints), Atlas Domain Scanner
- Not run
- The Have I Been Pwned browser email search, the Atlas Darkweb Intelligence and Breach Monitoring forms, and any tool behind a sign-in
- Re-test
- By 19 January 2027
What We Ran and What Came Back
Have I Been Pwned. Its home page counted 1,047 breached sites and 17,846,550,965 breached addresses when we looked. Asking its API about test@example.com returned HTTP 401 with the message “Access denied due to missing hibp-api-key”. Its plan page lists the entry paid tier, which adds direct email search through the API, at $4.39 a month on annual billing ($52.68 a year). The same page lists as free the browser email search, email notifications, the Pwned Passwords service and monitoring of domains with up to 10 breached addresses. Domain search needs proof that you control the domain.
Two free endpoints worked without a key. The full breach list returned 1,047 entries in one request. The Pwned Passwords service returned 1,924 hash suffixes for one five-character prefix. We did not run the email box on the home page, so we have no output to show from it.
Atlas Domain Scanner (our tool). We scanned example.com in a normal browser. The scan finished in under 20 seconds, and the page graded the domain F with a risk score of 87 out of 100. The areas it reported:
- Breach monitoring: device and credential counts shown as 20,000+, which Atlas says is a lower bound for very large counts.
- Third-party breach records naming the domain: 16,729,305.
- Dark web mentions: 2,178. Dark chat mentions: 11,409.
- Lookalike domains: 434. Exposed documents: 2,692.
- Data sales: a current listing and 56 past ones.
Read this as a demo of the output format, not as a finding. Example.com is a name reserved for documentation, and the string appears everywhere. A request for the PDF report reached the test mailbox by email in about two minutes. The Darkweb Intelligence and Breach Monitoring pages describe narrower checks on the same data. Their search forms use a bot check that blocks scripts, so we read those pages but did not run them. Breach Monitoring takes a corporate domain and does not support free webmail.
| Aspect | What we ran | What came back | What it needs |
|---|---|---|---|
| Have I Been Pwned API | Email lookup for test@example.com | HTTP 401, missing API key | A key from a paid plan |
| Have I Been Pwned free endpoints | Breach list and password range | 1,047 breaches and 1,924 hash suffixes | Nothing |
| Atlas Domain Scanner (our tool) | Scan of example.com | Grade F, 87 of 100, counts by area, PDF by email | A company domain, not a personal email |
Which Tool Fits Which Situation
- Checking an email address against known breaches: Have I Been Pwned documents a free browser search, which we did not run. Its email search API needs a paid key.
- A company domain: Have I Been Pwned documents domain monitoring for domains you prove you control. We did not run it. Atlas, which we did run, gives a grade and counts only and does not take a personal email.
- Full posts, the actor behind them, alerts and takedowns: that is the job of a service, such as Brandefense dark web monitoring. The Atlas pages say the full platform adds these.
New to the topic? Our glossary explains what dark web monitoring is and what it covers.
Where Dark Web Monitoring Stops
A count tells you that something exists, not what to do about it. Atlas explains on its Breach Monitoring page that a stealer-log entry is one line per stolen account: site, username and password. It adds that resetting a password does nothing while the malware is still on the device. That is why the last step below is about the device, not only the password. You can read how stealer logs are collected in our glossary.
- Change the exposed passwordUse a new one on that site only.
- Turn on a passkey or second stepGoogle lists passkeys among its tools.
- Use a different password on each siteReuse lets one breach open other accounts.
- For a company, clean the device firstA reset does nothing while the malware stays.
We will run these tests again by 19 January 2027 and add the Have I Been Pwned browser email search if we can run it on a test mailbox. Tool pages change, so treat the limits above as a snapshot.