How to use Dark Web Monitoring

If your personal information gets leaked to the dark web, Proton’s Dark Web Monitoring feature notifies you so you can take action. It also lets you know about potential risks to your personal data, and tells you what you can do to mitigate those risks.

Dark web leaks typically occur when a third-party service you use is compromised. This could be due to negligence on their part, or a deliberate attack from a cybercriminal. Learn more about how Dark Web Monitoring protects you.

Anyone with a paid Proton plan can use Dark Web Monitoring. It’s especially helpful in Proton Pass and Proton Mail, where you can ensure that any and all of your email aliases haven’t been breached.

• Enable Dark Web Monitoring for Proton Mail
• Enable Dark Web Monitoring for Proton Pass
• Enable Dark Web Monitoring for all Proton apps
• Check Dark Web Monitoring
• Dark Web Monitoring breach notifications
• How Dark Web Monitoring works
• What data does Dark Web Monitoring check for?
• Best practices for avoiding data leaks

Enable Dark Web Monitoring for Proton Mail

1. Go to Proton Mail and open your account settings (Settings ⚙ > All settings).

2. Select Security and privacy from the sidebar.
3. Scroll to Dark Web Monitoring. Toggle on Enable Dark Web Monitoring and Enable email notifications.

Dark Web Monitoring is enabled. If your data is leaked on the dark web, we’ll let you know.

Enable Dark Web Monitoring for Proton Pass

1. Go to Proton Pass and open your account settings (Settings ⚙ > Account).

2. Select Security and privacy from the sidebar.
3. Scroll to Dark Web Monitoring. Toggle on Enable Dark Web Monitoring and Enable email notifications.

Dark Web Monitoring is enabled. If your data is leaked on the dark web, we’ll let you know.

Enable Dark Web Monitoring for all Proton apps

You can enable Dark Web Monitoring in the Security center or on your Settings page under Security and privacy.

Check Dark Web Monitoring

If you have a paid Proton Account, you can find Dark Web Monitoring in the Security center or on your Settings page under Security and privacy.

If you have a paid Proton Pass account, you can also find Dark Web Monitoring under Pass Monitor on the side panel of Proton Pass. Here, you can check for breaches of your Proton addresses, email aliases, and custom emails.

You can see all the email addresses associated with your Proton account from the Dark Web Monitoring dashboard — including any hide-my-email aliases(uusi ikkuna) you may have created, and up to 10 custom email addresses you can authorize to monitor. If these addresses have been exposed in a data breach from a third-party service, you’ll see an alert in the Status column. The alert will also suggest actions you can take to secure your account and mitigate risks.

At the bottom of the list you’ll also find some suggested custom email addresses you may want to monitor. You can add up to 10 verified custom email addresses, these are non-Proton addresses and hence will be shared with third party providers if you enable them for monitoring. Click on add to add them to the list and start monitoring them.

Dark Web Monitoring breach notifications

Dark Web Monitoring will show all known breaches that have affected your accounts over the last two years. Breaches are sorted into two categories:

• Red breaches: These breaches require immediate attention, typically to change passwords that were exposed as plaintext or weakly hashed (for example, using MD5).
• Purple breaches: Breaches that affected your accounts but where your password was encrypted or strongly hashed (for example, with SHA256 or bcrypt). These breaches can still expose sensitive personal information, so make sure to take action.

For more information about what to do if your data is leaked online, check our our blog post on data breach recommendations.

How Dark Web Monitoring works

We use various data sources for breach detection, including our own threat intelligence datasets enriched with data from Constella Intelligence. Constella has access to information being sold on the dark web.

Our sources alert us whenever they find leaked information or data stolen in a hack from a third-party online service that’s tied to a Proton Mail email address or a Proton Pass alias.

What data does Dark Web Monitoring check for?

Dark Web Monitoring will let you know if the following information has been exposed:

• Email address
• Username
• Name
• Date of birth
• Passwords
• Phone number
• Physical addresses (including city and ZIP codes)
• Government IDs:
  • Social Security Number (SSNs)
  • Social Insurance Number (SINs)
  • National ID (NIDs)
  • Tax Identity Number
  • Visa number
  • Passport details
  • Driver’s license details
• Medical information
• Financial information
  • Credit card details
  • Bank IBAN

Best practices for avoiding data leaks

Create email aliases

Email aliases protect your real email address and identity, limiting the blast radius of a breach. Create unique aliases to sign up for online services and accounts with Proton Mail and Proton Pass.

Create strong passwords

All of your accounts need a unique and strong password. Proton Pass can help you generate strong passwords, avoid password reuse, and autofill passwords next time you log in.

Hide your IP address

Hiding your IP address prevents your location and internet traffic from being leaked. Use Proton VPN with NetShield(uusi ikkuna) enabled to hide your IP address and protect yourself from phishing and malware.