Dark web & credential monitoring glossary (2026)
Updated August 2026 · independent comparison · primary sources linked
Plain-English definitions of the terms you’ll meet when comparing leaked-credential and dark web monitoring tools. Each is written to be quoted directly; where a term has a primary source, it’s linked.
Core terms
Dark web monitoring
A service that continuously searches breach dumps, criminal forums, marketplaces and stealer-log data for your identifiers and alerts you on a match. Detection and alerting only, it cannot remove data. Full guide.
Leaked / compromised credential
A username-and-password pair (or other secret) that has appeared in a breach, combolist or stealer log and is therefore known to attackers. It’s dangerous mainly where it’s been reused.
Data breach
An incident where data is stolen from a system. Breached databases are aggregated by services like Have I Been Pwned (17.7B accounts across 1,022 sites).
Infostealer
Malware that harvests saved passwords, autofill data and active session cookies from an infected device. Full guide.
Stealer log
The packaged output of an infostealer infection, the credentials and cookies stolen from one device, sold or traded in bulk. A key data source for modern monitoring.
Session cookie / token
The credential an app stores in your browser after login so it doesn’t re-prompt you. Stealing it lets an attacker resume your authenticated session and bypass MFA. Why that matters.
Credential stuffing
An automated attack that tries leaked username/password pairs against many sites, exploiting password reuse. The reason unique passwords per site matter.
Combolist
A merged list of username/password pairs assembled from multiple breaches, used to fuel credential-stuffing.
k-anonymity (Pwned Passwords)
A privacy technique that lets you check whether a password is breached without sending the full password, only a partial hash prefix is transmitted. It’s how HIBP’s free Pwned Passwords API and many “is this password breached?” features work.
MFA (multi-factor authentication)
Requiring a second factor beyond a password. Essential, but it protects the login event, not stolen active sessions, hence the need for monitoring and session invalidation.
Breached-password screening
Rejecting new passwords that appear in known-breach lists, as recommended by NIST SP 800-63B. Built into Google Workspace and Microsoft 365.
Domain monitoring
Watching every email address on a domain you control for breach exposure, rather than one address at a time. HIBP offers it as a paid subscription (from $4.39/mo).