Two different questions
Breach tools answer two separate questions. Is my email address, or my card number, in a leaked database? And is a password in my vault already known to attackers, or weak, or reused? Vendors bundle these differently, and the difference decides which plan you need.
NordPass splits them cleanly: Data Breach Scanner watches email addresses and credit cards you provide, while the Exposed category in Password Health checks your stored passwords. 1Password puts both kinds of signal into Watchtower. Bitwarden runs separate reports, one of which is free.
Feature by feature
| Question | NordPass | 1Password | Bitwarden |
|---|---|---|---|
| Feature names | Data Breach Scanner; Password Health (Weak, Reused, Exposed) | Watchtower | Vault health reports; Data Breach report |
| Tier | Premium and Family; not on Free | Listed on 1Password plans; all plans are paid | Data Breach report free for all users; other reports need Premium or a paid organization |
| Email or account monitoring | Yes, after verifying each address by code | Not email-based: flags saved logins for websites with a reported breach | Data Breach report uses Have I Been Pwned; the page does not describe ongoing email alerts |
| Card monitoring | Yes, up to 50 cards | Not described | Not described |
| Password exposure check | Hashes passwords, sends a small snippet mixed with random hashes to a third-party provider, filters on device | First five characters of a 40-character hash sent to Pwned Passwords; matching on device | First five characters of the password hash sent to a trusted web service; matching done locally |
| Other checks | Weak and reused passwords | Reused, weak, unsecured websites, missing 2FA, expiring items, passkeys available | Reused, weak (zxcvbn), unsecured websites, inactive 2FA |
How each one works, per its documentation
NordPass: Data Breach Scanner scans leaked databases for email addresses and cards you add. Each email must be verified with a code. Results show a red banner for new or unresolved breaches and a green banner when nothing is found; you can reveal leaked data and mark a breach resolved. NordPass notes that dark-web data can be incomplete and that a breach is not always an email and password pair. The Exposed Passwords check can be turned off in settings, which removes its data.
1Password: Watchtower flags compromised websites where you have not changed the password since a reported breach, vulnerable passwords exposed in breaches, and several hygiene issues. Its privacy page says 1Password creates a 40-character hash of each password, sends only the first five characters to the Pwned Passwords service from haveibeenpwned.com, and compares the returned list on your device. Compromised-website data is downloaded and compared locally, so your list of sites is not sent out.
Bitwarden: the Data Breach report uses Have I Been Pwned and is free for all users. Exposed Passwords sends the first five characters of each password hash to a trusted web service and compares locally. Reused, Weak (scored with zxcvbn), Unsecured Websites and Inactive 2FA (using 2fa.directory data) complete the set, and Bitwarden says most of these need Premium or a paid organization.
The free alternative
Have I Been Pwned says it is intended as a free service: you can search an email address on demand and subscribe to notifications for future breaches. Its Pwned Passwords service lets you check whether a password has appeared in a breach, with the search anonymised before it reaches the site.
Apple Passwords also alerts you when saved passwords appear in known data leaks, at no cost on supported Apple devices. If you are on a free plan elsewhere, these two cover the basic warning signal; paid vault features add card monitoring, hygiene reports and one dashboard.
What to do when an alert fires
- Change the password on the affected website first, then update it in the vault. NordPass gives this exact order.
- Search the vault for the same or a similar password and change those too; reused passwords are how one breach becomes several.
- Turn on two-factor authentication for the account if it offers it; Watchtower and Bitwarden Inactive 2FA both flag sites that support it.
- If a card number leaked, contact the issuer about a replacement.
- Mark the alert resolved only after the change is saved, so the dashboard stays meaningful.
- If an alert names an unknown domain, NordPass says it may not be able to clarify it; change any password you used with that email anyway.
Questions before you decide
Is any breach monitoring free?
Yes. Bitwarden says its Data Breach report is free for all users, Have I Been Pwned offers free email searches and notifications, and Apple Passwords alerts on leaked passwords.
Does the password manager send my passwords to check them?
Not according to their documentation. 1Password and Bitwarden send only the first five characters of a password hash and compare results on your device; NordPass hashes passwords and filters matches on device.
Is NordPass Data Breach Scanner on the free plan?
No. The NordPass plans page lists Data Breach Scanner and Password Health as not included on Free and included on Premium and Family.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- NordPass: how to use the Data Breach Scanner Accessed 30 Oct 2026
- NordPass: how to use the Password Health feature Accessed 30 Oct 2026
- NordPass: Exposed Passwords FAQ Accessed 30 Oct 2026
- NordPass: plans Accessed 30 Oct 2026
- 1Password: Watchtower Accessed 30 Oct 2026
- 1Password: about Watchtower privacy Accessed 30 Oct 2026
- 1Password: password manager pricing Accessed 30 Oct 2026
- Bitwarden: vault health reports Accessed 30 Oct 2026
- Bitwarden: pricing Accessed 30 Oct 2026
- Have I Been Pwned: FAQs Accessed 30 Oct 2026
- Apple: use the Passwords app to create, manage, and share passwords and passkeys Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.