Find a plan. Search via the web or API.
91,204,808,300 records 23,131 leak sources indexed Peer reviewed method (MDPI)
For solo researchers who run quick lookups.
$16.67/mo
$200 billed yearly
or $16.67/mo billed yearly · save $39.88
Results are masked
Clear Data starts at Professional
Cancel anytime
What you get:
Available in Professional:
For analysts who investigate leaks every day.
$41.67/mo
$500 billed yearly
or $41.67/mo billed yearly · save $99.88
See full emails, usernames and passwords instead of masked ones. $1,000 billed yearly.
Recommended for investigations · see the difference
Cancel anytime · Secure checkout by Stripe
Billed yearly: $500 plan + $1,000 Clear Datamonthly: $49.99 plan + $100 Clear Data
Everything in Investigator, plus:
For SecOps teams and MSSPs that protect whole domains.
$332.50/mo
$3,990 billed yearly
or $332.50/mo billed yearly · save $798
Clear Data included
No add on needed
Cancel anytime
Everything in Professional + Clear Data, plus:
For governments and large organisations that need full scale.
Everything in Agency, plus:
New here? You’ll sign in or create a free account before checkout.
Just checking your own email? Searching is free and anonymous, no account needed. Universities, hospitals, NGOs and journalists can apply for free Community Access (up to 100 searches a day) from an institutional email.
Short clips of each feature, recorded on haveibeenransom.com with demo data. Every card tells you what it does and which plans include it.
In every plan
Record count, file types and corporate vs personal emails at a glance: before you open a single file.
In every plan
Download your results as CSV or JSON and drop them straight into your own tools. Agency can also export a whole search in one file.
Credential fragment 03/06/2026 09:16
Inside a ransomware leak
******* Pixelated information. If you want to see full clear data… *******
Professional add on
Turn masked emails, usernames and passwords into the real values: and see the exact sentence where an email appears in a leaked file.
Agency & Gov only
Services, employees, breaches, stealer logs and ransomware for any domain: on one screen.
Agency & Gov only
Enter a domain, pick the language and get a password protected PDF intelligence report.
See a sample report (PDF, 0.9 MB)
Agency & Gov only
Download the original .7z archive with its password and analyse every file yourself.
Agency & Gov only
Open document images linked to a matching record and inspect the original evidence.
Hover to watch a feature, or click it to open the clip with controls. explains a row.
| Features | Investigator $16.67/mo | Recommended Professional $41.67/mo + Clear Data | Agency $332.50/mo | Gov Custom Talk to us |
|---|---|---|---|---|
| Search & data | ||||
Requests per dayWeb searches and API calls share one daily quota.
|
100 | 2,000 | 20,000 | Unlimited |
| Masked | Masked+$100/mo for Clear Data | Clear | Clear | |
Ransomware leak searchNames, emails and IDs inside leaked documents, databases and mailboxes.
|
Not included | Included | Included | Included |
Every dataset in one searchRansomware, breaches, ULP and stealer logs in a single search.
|
Not included | Included | Included | Included |
Sort results by date
|
Not included | Included | Included | Included |
Full password stream and stats
|
Not included | Included | Included | Included |
| Investigation tools | ||||
Leak IntelWhat’s inside a leak, before you open it.
|
Included | Included | Included | Included |
Domain overviewOther plans see demo data.
|
Demo data | Demo data | Included | Included |
Raw stealer log archives (.7z)
|
Not included | Not included | Included | Included |
Leaked document images
|
Not included | Not included | Included | Included |
| Export & automation | ||||
Export loaded results (CSV / JSON)
|
Included | Included | Included | Included |
Export the whole dataset
|
Not included | Not included | Included | Included |
Larger API pages
|
Not included | Not included | Included | Included |
MCP integrationAvailable for Professional, Agency and Gov. Read only exposure summaries for authorized emails and domains, with up to 100 MCP searches per day per account.
|
Not included | Included | Included | Included |
Webhooks
|
Not included | Not included | Included | Included |
| Monitoring & reports | ||||
Monitoring fields with alerts
|
15 | 30 | 100+ | Unlimited |
| Not included | Not included | 30 / month | Unlimited | |
| Billing & support | ||||
Billing
|
Monthly or yearly | Monthly or yearly | Monthly or yearly | Custom contract |
Support
|
24h | 24h | 24h | 24h |
Automatic PDF invoices
|
Included | Included | Included | Included |
| Darkeye ecosystem | ||||
Breach House access (opens breach.house)Darkeye’s ransomware leak crawler, at breach.house.
|
Not included | Limited | Included | Included |
Darkeye.io OSINT panel (opens connector.darkeye.io)Darkeye’s OSINT automation panel, at connector.darkeye.io.
|
Not included | Not included | Demo | Full access |
$1.37 a day on yearly billing. Less than a coffee.
2,000 requests a day across the web and the API, instead of 100 on Investigator.
Find names, emails and IDs inside the documents, databases and mailboxes that ransomware groups publish. The method is peer reviewed.
Add Clear Data for $100 a month and read full credentials instead of masked ones. Try the demo.
Sort results by date, export them as CSV or JSON and analyse full password data.
Running a SOC or an MSSP? Cybersecurity Agency adds domain overview, AI reports and raw archives.Compare with Agency
Yes. Upgrades and downgrades within the same billing cycle apply right away, and Stripe prorates the difference on a single invoice. Moving between monthly and yearly billing starts a new subscription, and the previous one is cancelled automatically.
You keep full access until the end of the period you paid for. After that your account moves to the free Basic tier: your account, API token and monitoring list stay, with Basic limits. AI reports can be downloaded for 45 days after they’re generated.
No. Plans renew every month or every year until you cancel, and you can cancel from your dashboard at any time.
Visa, Mastercard, American Express, Apple Pay, Google Pay and Amazon Pay, all through Stripe. To pay with crypto, email [email protected].
No tax is added. Prices are in US dollars, and the price you see is the price you pay.
Universities, hospitals, NGOs and journalists can apply for free Community Access (up to 100 searches a day) from an institutional email. Larger teams can ask about the Gov plan, and promo codes are accepted at checkout.
Without it, results are masked: you see the first characters of emails, usernames and passwords, like lfe*******@darkeyexample.xyz. With Clear Data you see the full values, plus the text around an email inside a leaked document. It’s included in Cybersecurity Agency and Gov. On Professional it’s a $100/month add on, and you can also add it later from your dashboard.
No. They share one daily quota: 100 requests on Investigator, 2,000 on Professional and 20,000 on Cybersecurity Agency. It resets every day, and analysing a leak in Leak Intel counts as one request.
Yes. Create a free account first: your plan and your API token are linked to it. Searching from the home page stays free and anonymous.
The API uses technical names: Investigator is pro, Professional is advanced and Cybersecurity Agency is enterprise. Messages that say “Enterprise plans only” refer to Cybersecurity Agency and Gov.
Cybersecurity Agency includes restricted, high level access to the Darkeye.io panel so you can evaluate it, without raw sensitive data. Full access comes with Gov.
Professional: 2,000 requests a day, ransomware leak search and Clear Data whenever you need it. Cancel anytime.
Prices in USD. Plans renew automatically until you cancel. See our Terms of Use.
New ransomware leaks, stealer dumps and platform updates — straight to your inbox.
We never share your email. Unsubscribe anytime.