Dark web monitoring pricing compared: what each tier really costs (2026)
Updated August 2026 · independent comparison · primary sources linked
Here is what leaked-credential / dark web monitoring actually costs a small business in 2026. Two options publish real prices: Have I Been Pwned (free to search and notify; domain monitoring from $4.39/month) and 1Password (breach flags bundled with the password manager). The enterprise tools, Dark Web ID, SpyCloud, Flare, do not publish prices and require a sales quote or an MSP. Below, every tier we could verify, and an honest read on the “call us” options.
| Tool | Who it’s for | Entry price | Domain monitoring | Pricing model |
|---|---|---|---|---|
| Have I Been Pwned (free) | Anyone | $0 | Email/notify free; domain search now paid | Free search + notify |
| HIBP “Core 1” | 1-domain SMB | $4.39/mo | 1 domain, 10 req/min API | Public self-serve tiers |
| HIBP “Core 3” | Small MSP/multi-brand | $36.99/mo | 5 domains, 100 req/min | Public self-serve tiers |
| 1Password (Watchtower) | Teams already on 1Password | $19.95/mo* team | Breach flags inside the vault, not a standalone monitor | Bundled with password mgr |
| Dark Web ID (Kaseya) | Sold through MSPs | No public price | Domain + personal monitoring | Quote / MSP channel |
| SpyCloud | Mid-market / enterprise | No public price | Deep recaptured-data + malware/session data | Enterprise sales quote |
| Flare | SMB → enterprise | No public price (demo/quote) | Dark web + stealer logs | Sales quote |
*1Password team billing is annual and per-user; the figure shown is the equivalent monthly team-plan minimum from 1Password’s pricing page. Watchtower is a feature of the password manager rather than a dedicated breach-monitoring service.
HIBP paid tiers in full
Have I Been Pwned’s self-serve subscriptions (from its API/subscription page) scale by API rate limit and number of monitored domains:
| Tier | Monthly | Annual | Domains | API req/min |
|---|---|---|---|---|
| Core 1 | $4.39 | $52.68 | 1 | 10 |
| Core 2 | $21.59 | $259.08 | 3 | 50 |
| Core 3 | $36.99 | $443.88 | 5 | 100 |
| Core 4 | $159 | $1,908 | 10 | 500 |
| Core 5 | $319 | $3,828 | 20 | 1,000 |
Why the enterprise tools hide their price
Dark Web ID, SpyCloud and Flare route buyers through a demo or an MSP because their pricing is scoped per deployment, number of assets, data feeds, integrations, seats. That’s normal for enterprise software, but it has a consequence for a small buyer: you can’t comparison-shop without booking calls, and the floor is usually well above SMB self-serve pricing. When you do get a quote, ask what it includes (stealer-log data? session/cookie coverage? personal + domain? managed triage?) so you can compare like-for-like against the ~$4.39, $36.99/mo you’d pay HIBP.
The honest recommendation by budget
| Budget | Best move |
|---|---|
| $0 | HIBP free search + notify, plus breached-password blocking in Google/Microsoft. Covers the basics. |
| ~$4, $37/mo | HIBP Core 1, 3 for continuous, automatic domain monitoring. Best value in the category. |
| Bundled | Already on a password manager? Use its built-in breach flags (e.g. 1Password Watchtower) for team logins. |
| Quote | Only step up to Flare / SpyCloud / Dark Web ID for stealer-log depth, session-data, or a managed MSP relationship. |