Responsible use

The one rule everything else follows from

DarkSint exists so that people and organisations can find their own exposure before someone else exploits it. Every other use of leaked credential data, such as looking up a person you are curious about, an ex-partner, or a competitor's staff, causes the harm the service is meant to prevent.

You may only search an identifier or domain that you own, that belongs to your organisation, or that you have a documented mandate to investigate: a signed engagement, an incident response you are staffed on, or an equivalent written authorisation.

If you cannot name who authorised a search, you are not authorised to run it.

The free check is verified, not open

The public exposure check on this site does not accept an address and return results. It sends a one-time code to the address being checked, and only produces a report once that code comes back. A report about an address can only ever reach someone who can read that address's mail. A domain report requires a code sent to an address at that domain.

The public report is deliberately aggregate: how many records, from how many sources, how old, and how weak the passwords were. It never returns an individual record, and it never reveals a credential.

What is never permitted

• Searching identifiers or domains you neither control nor have written authorisation to investigate.
• Using revealed credentials to sign in to any account. Testing whether a password still works is unauthorised access, whoever the account belongs to.
• Credential stuffing, password spraying, or feeding results into any tool that attempts authentication.
• Stalking, harassing, profiling, doxxing, or building a dossier on an individual.
• Reselling, redistributing, or republishing data obtained through DarkSint, in whole or in part.
• Scraping the service, sharing an account, or circumventing plan limits, rate limits, or the credit system.
• Using the service where doing so breaks the law that applies to you, or to process data you are not lawfully allowed to process.

If you do reveal a credential

Revealing a record puts real, still-valid credentials in your hands. Treat them as you would a production secret:

• Use them only to drive remediation: a forced reset, a revoked session, a notified user.
• Do not store or forward them beyond what that remediation needs, and delete your copies when it is done.
• Do not paste them into tickets, chat, or documents that a wider audience can read.
• Tell the affected person or team, where you are able to. Exposure you sit on is exposure that stays exploitable.

Revealed records are stored encrypted and are private to your account. What you do with them after you reveal them is your responsibility, not ours.

How this is enforced

Every search is logged against the account that ran it, including what was searched and when. We use those logs to detect patterns that indicate abuse, such as bulk lookups of unrelated identifiers, or activity inconsistent with a legitimate engagement.

Where we believe this policy has been broken we may suspend the account immediately, without a refund for the remaining period, and we may report unlawful activity to the relevant authorities. We would rather warn you first, and usually will, but a serious breach does not get a warning.

Reporting abuse

If you believe DarkSint is being used against you, write to support@darksint.com. Tell us what you can verify and we will investigate.

DarkSint does not collect breach data itself; it reports on data already circulating from a third-party source. That means we can suspend a user and we can act on what our own system exposes, but we cannot remove a record from the internet on your behalf.

Security researchers: please report vulnerabilities to support@darksint.com before disclosing them publicly. We will not pursue anyone who reports a genuine issue in good faith and gives us reasonable time to fix it.