Dark Web Prices List

Dark Web Prices List: At-a-Glance Reference Table

This reference table summarises reported prices for various items available on the dark web, providing quick insights into the value of illicit goods and services. We sourced data from recent analyses that highlight price ranges, unit sales, and the reliability of the information. This overview is useful for cybersecurity professionals, journalists, and students aiming to understand the landscape of dark web pricing without implying that these figures reflect actual transaction values.

These price ranges reflect a snapshot of the market as of 2025-2026, based on a study that analysed thousands of listings for accuracy and uniqueness. The figures vary due to the fluctuating nature of the dark web, where prices can be influenced by supply, demand, and the specific context of the listings^[1][2]. Understanding these dynamics is crucial for anyone engaging in discussions about cybersecurity and the implications of data breaches.

How to Read a Dark Web Price Listing

Navigating dark web price listings requires familiarity with specific terminology. Here’s a compact glossary of essential terms:

• Per Record: Price for each individual data entry.
• Per Account: Price for access to a single account, often linked to email or payment services.
• Fullz: Comprehensive identity packages including personal information like Social Security numbers.
• CVV: Card Verification Value, a security feature for credit cards, often sold with payment data.
• Log: A record of account activity that may be sold to indicate access.
• Balance: The amount of money available in an account, which can affect its value.
• Freshness: Indicates how recently the data was obtained, impacting its reliability.
• Verified: Refers to whether the information has been confirmed as accurate by the seller.
• Bulk Lot: A collection of multiple listings sold together, usually at a lower price per item.
• Vendor Reputation: An assessment of a seller's reliability, often based on previous transactions and customer feedback.

While a low advertised price might seem appealing, it often signifies unverified, duplicated, or expired data, or it may be subject to geographical restrictions. For instance, a fictional listing might show an email account priced at $2, labelled "unverified," aged six months, with a balance of $0. This suggests the account is likely less valuable than a verified account with recent activity and a positive balance.

Understanding these terms and their implications will help readers critically evaluate listings and their associated risks.

Stolen Passwords, Email Accounts, and Account Access

The dark web market for stolen passwords and account access varies significantly based on the type of account and its associated privileges. For example, ordinary personal email accounts can be purchased for as little as $1, while U.S. Office 365 accounts average around $25.32, with a median price of $26.50^[1]. This indicates that the value of an account often correlates with its functionality and the potential for reuse.

Streaming and social media accounts typically fall within a similar range, but the specifics can greatly influence prices. Business logins, particularly for financial services, command higher prices; access to a PayPal account averages $106, while Chase and Wise accounts can go for $619 and $803, respectively^[1]. The difference in pricing reflects not only the account type but also the privileges associated with them. Accounts with higher balances or administrative privileges tend to be priced higher due to their potential for misuse.

Remote-access credentials and bundled logs from infostealers also exhibit a wide price range. Stealer subscriptions can be found from $15 to $500, while remote-access trojans range from $200 to $2,000^[2]. The value of these listings can fluctuate based on factors such as the region from which the data originates and the recency of validation. Validated accounts or those with recent activity are typically more expensive, as they are perceived as more reliable and valuable.

Understanding these price dynamics is crucial for cybersecurity professionals and analysts assessing the risks associated with compromised accounts. Prices can vary widely based on the context, making it essential to approach listings with a critical eye.

Payment Data, Identity Records, and Medical Information

The pricing for payment data, identity records, and medical information on the dark web shows significant variation based on several factors, including the completeness and freshness of the data. For instance, U.S. payment-card listings average $11.86, with a median price of $10^[1]. In contrast, identity bundles, known as "fullz," which can include Social Security numbers and other personal details, are advertised for as little as $37^[1]. This disparity arises because a complete identity package provides more potential for identity theft and fraud, making it more valuable than isolated pieces of information, such as a single email or card number.

When it comes to specific types of data, digital passport scans can be found at a median price of $34.99, while physical passports can reach up to $1,500 due to the effort required to produce them^[1]. This reflects how the format and production complexity influence pricing. Medical identity theft is particularly concerning, as it can lead to fraudulent claims and significant harm to victims' medical records; however, specific pricing for medical records is less frequently reported in the available literature.

For online banking access, prices vary dramatically. Access to a PayPal account averages around $106, while Chase and Wise accounts can command prices of approximately $619 and $803, respectively^[1]. These figures illustrate how the level of access and associated privileges can significantly impact the value of the data being sold.

Understanding the nuances of these prices is essential for cybersecurity professionals and analysts, as they highlight the risks associated with compromised personal information. The freshness and verification status of the data also play a crucial role in determining its market value, with more recent and verified listings generally commanding higher prices.

Malware, Initial Access, and Illicit Digital Services

The dark web presents a range of prices for malware, initial access, and various illicit digital services, which can vary significantly based on factors such as the type of service, subscription model, and the privileges associated with access. For instance, malware subscriptions, such as stealers, can cost between $15 and $500, depending on the sophistication and capabilities offered^[2]. Remote-access trojans generally fall within the $200 to $2,000 range, while exploits can command prices up to $5,000^[2]. These prices reflect the demand for tools that facilitate unauthorized access to systems and data.

Initial access to compromised organizations is particularly costly, with average sale prices reported at approximately $2,700. Notably, nearly 40% of these offers are priced between $500 and $1,000, with 71.4% including some level of access privilege^[3]. This indicates that while there are lower entry points, higher prices often correlate with the extent of access and the potential for exploitation.

Pricing models also vary, with some services offered as one-time fees while others operate on subscription or revenue-sharing models. For example, stealer subscriptions may be a recurring cost, whereas initial access might involve a one-off payment. Additionally, the pricing structure can be influenced by the size of the victim organization; larger entities typically command higher prices due to the increased potential for profit from compromised data.

Understanding these dynamics is crucial for cybersecurity professionals and analysts assessing the risks associated with digital threats. The fluctuating nature of these prices, influenced by supply, demand, and the specific context of the listings, underscores the importance of a critical approach when evaluating the dark web's offerings^[1].

Counterfeit Documents and Other Illicit Physical Goods

Counterfeit documents and other illicit physical goods are prevalent on the dark web, with various categories including counterfeit IDs, forged documents, counterfeit currency, and controlled goods. The pricing for these items can vary significantly based on factors such as the type of document and the country of origin. For example, a digital passport scan can be found for around $34.99, while a physical passport may cost approximately $1,500^[1]. Counterfeit IDs typically range from $100 to $300, depending on the quality and the country of issuance, while forged documents can range from $50 to $500 based on complexity and authenticity^[1].

Counterfeit currency is another category where prices fluctuate. For instance, counterfeit notes can be priced between $200 and $1,000 depending on denomination and quality^[1]. Controlled goods, including items like firearms or drugs, also appear on various dark web marketplaces, but pricing is often inconsistent due to legal risks and enforcement actions in different regions.

It is crucial to be aware that many listings for these items are scams, and possession or purchase of counterfeit documents may carry serious criminal penalties. Engaging with these markets poses significant legal risks, and potential buyers should approach with caution. The prices mentioned reflect a snapshot of the market, which is influenced by various factors, including supply and demand dynamics^[1].

Why Dark Web Prices Vary—and Why Listings Can Be Misleading

Dark web prices fluctuate based on several key variables, including freshness, validity, completeness, account balance, privileges, geography, exclusivity, quantity, seller reputation, and cryptocurrency volatility. For instance, listings for stolen data can vary widely; a recently obtained email account with a positive balance may command significantly higher prices than an outdated account with no activity. Seller reputation also plays a crucial role; well-reviewed sellers can charge more due to perceived reliability, while lesser-known vendors may offer lower prices but with higher risk of scams or invalid products.

When evaluating price claims, it's essential to have a checklist for spotting unreliable listings. Look for missing dates that might indicate outdated information, undefined units that leave ambiguity about what is being sold, recycled screenshots that lack authenticity, unverifiable samples that cannot be traced back to a legitimate source, and conversions from cryptocurrency without an exchange-rate date, which can misrepresent value.

To illustrate normalization, consider a bulk lot of 100 stolen account listings priced at $1,000. The price per record would be calculated as follows: $1,000 divided by 100 records equals $10 per record. This method helps in assessing the true value of individual listings, allowing for more informed decisions.

Understanding these pricing dynamics and employing critical evaluation techniques is vital for anyone navigating the dark web market, especially for professionals in cybersecurity who must assess the risks associated with compromised data.

Dark Web and Onion Links: Essential Terms and Safety Boundaries

Understanding the distinct terminology associated with the dark web is crucial for those researching its dynamics. The surface web comprises publicly accessible sites, while the deep web includes unindexed content that requires specific permissions. The dark web, a subset of the deep web, is intentionally hidden and accessible only through specialised software, primarily Tor. Tor is free and open-source, enabling users to access the dark web without subscription fees, although standard internet and device costs may still apply^[4].

An onion service is a unique type of web service accessible exclusively through the Tor network, identifiable by its 56-character .onion address^[5]. While these onion links can lead to various marketplaces and forums, they do not guarantee legitimacy or safety; many listings may be scams or contain harmful content. Users must exercise caution and maintain a critical perspective when navigating these spaces.

Directories and mirrors can also be found on the dark web, providing alternative access points to sites that may be taken down or blocked. However, these resources should not be considered foolproof, as they can lead to harmful or illegal content. For legitimate research, we recommend consulting public threat reports and archived evidence from law enforcement, which can provide verified insights without engaging directly with potentially dangerous marketplaces. Understanding these terms and their implications will help readers critically evaluate listings and their associated risks.

Who This Price List Suits

If you are assessing personal exposure — choose identity and account-access comparisons

We recommend these categories because they show how document format, account privileges, data freshness and verification can affect advertised value. Treat the figures as risk indicators rather than resale values; they do not confirm that a listing is genuine or that a transaction occurred.

If you are a journalist — choose normalised, source-backed price ranges

Use per-record calculations and separate digital records from physical counterfeits, because bulk totals and mixed formats can distort comparisons. This approach works when listings include dates, quantities and defined units; it does not work reliably with recycled screenshots, unverifiable samples or undated cryptocurrency conversions.

If you are studying cybersecurity — choose malware and access-model comparisons

These categories help us compare subscription tools, one-off access sales and privilege-based pricing without interacting with criminal marketplaces. Stealer subscriptions are reported between $15 and $500, while remote-access trojans range from $200 to $2,000^[2].

If you manage small-business security — choose initial-access and privilege data

We suggest focusing on access scope because criminal pricing can indicate which permissions and compromised organisations attract greater interest. Reported initial-access offers average about $2,700, while nearly 40% fall between $500 and $1,000^[3]; use these figures for threat modelling, not procurement or direct marketplace research.

If you are researching document fraud — choose format-separated comparisons

Compare digital scans, counterfeit IDs and physical documents independently, because production effort and document type materially change advertised prices. A passport scan has a reported median price of $34.99, whereas a physical passport may reach $1,500^[1]; this distinction is useful only when the source clearly defines the item and format.

Verdict: What to Choose

For most readers, we recommend a source-backed, normalised price list used strictly as a defensive risk benchmark. Choose account-access and identity-data comparisons for personal exposure, while security teams should prioritise initial-access, privilege and malware categories; our Dark Web Hacking guide provides related threat context.

Journalists should choose datasets with clear dates, units, sample sizes and deduplication methods. Cybersecurity students may prefer category comparisons that explain how access scope, freshness and format affect advertised prices.

Avoid live marketplaces, seller contact, unverified onion directories and lists built from recycled screenshots. Advertised prices are not proof of genuine goods or completed transactions, so use them for reporting, threat modelling and incident prioritisation rather than purchasing decisions.