Maybe a breach alert landed in your inbox, a login notification looks unfamiliar, or a friend says your account is sending odd messages. Whatever the trigger, the fix is more than typing a new password. The order of your actions matters, because a careless reset can leave an intruder still signed in or hand your new password to a fake login page. For a related guide, see Still Logged In on an Old Device? How to Sign Out of All Sessions. For a related guide, see Suspicious Activity on Your Social Media Account? Secure It Now. For a related guide, see Email Account Locked? How to Recover and Prevent It.
This guide walks through what to do first, how to change a password safely, and what to check afterward so the problem doesn't quietly return.
Start with the quick version
- Make sure the device you're using is trustworthy. Update it and run a malware scan if anything has seemed off.
- Secure your email account first, since it can reset almost everything else.
- Change the password to a new, unique one, ideally generated by a password manager.
- Sign out all other sessions and devices.
- Turn on two-step verification, preferably with a passkey, security key, or authenticator app.
- Check recovery details and account settings for changes you didn't make.
- Change any other account that used the same or a similar password.
Why the order matters
Your email inbox is usually the master key. Nearly every "forgot password" link goes there, so if someone controls your email, they can take over your other accounts one by one. Fixing a shopping account first while your email is still exposed accomplishes very little.
The device matters too. If a keylogger or other malware is on your computer, a new password may be captured as you type it. If you suspect that, update your system, run a scan with built-in or reputable security software, and consider changing the password from a different, clean device.
How to change a compromised password safely
Go to the real site yourself
Type the service's address directly or use your own bookmark or official app. Don't click a link in an email or text claiming your password was compromised. Fake security alerts are a common phishing tactic, and they're especially convincing right after a real breach is in the news.
Choose a password that has never been used anywhere else
Reuse is what turns one breach into several. Attackers routinely try leaked email-and-password pairs on other popular services, so a password that was safe on its own can fail because of a different site's breach.
- Let a password manager generate a long, random password. The manager built into your browser or phone works fine if you don't want a separate app.
- If you must remember it, such as for your device login or the manager itself, use a passphrase of several unrelated words.
- Avoid small tweaks like adding a number or changing
2024to2025. Attackers expect these patterns.
Sign out everywhere else
This step is easy to skip. On many services a password change does not automatically end every active session, so someone who is already logged in may stay logged in. Look in the account's security settings for a recent-activity or devices page, and choose the option to sign out of all sessions or remove unfamiliar devices. The exact wording and location differ by service, so look for those terms rather than a fixed menu path.
Add protection so the new password isn't your only defense
Two-step verification (also called two-factor authentication) means a stolen password alone isn't enough. Your options, from strongest to weakest:
- Passkeys or hardware security keys: highly resistant to phishing, and supported by a growing number of major services.
- Authenticator apps: generate time-based codes on your phone and are a solid general choice.
- Text message codes: weaker, because phone numbers can be hijacked, but still far better than no second step.
If you enable an authenticator app, save the backup codes the service provides and store them somewhere separate from your phone. Losing your only second factor is a common way people lock themselves out.
Check for changes the intruder may have left behind
Once you're back in, don't assume the job is finished. Someone with access, even briefly, may have set things up to keep it. Review these:
- Recovery email and phone number: make sure they're yours.
- Email forwarding and filter rules: attackers sometimes forward copies of your mail elsewhere or auto-delete security alerts.
- Connected apps and third-party access: remove anything you don't recognize.
- Recent activity and sent messages: look for logins or emails you didn't make.
- Saved payment methods and addresses: confirm nothing was added or changed.
Which other accounts to change, and in what order
You don't need to change every password in a panic, but prioritize by damage potential. Work through them in this sequence:
- Email accounts, including old ones that still receive mail
- Your main Apple, Google, or Microsoft account
- Banking, payment, and financial services
- Your password manager, if you use one
- Social media and shopping accounts
- Anything else that shared the compromised password
A breach-checking service such as Have I Been Pwned can tell you whether your email address appeared in known leaks. It's a useful guide, but a clean result doesn't prove an account is safe, because not every breach is public.
If you can't log in anymore
If the password no longer works, an attacker may have changed it. Use the service's official "forgot password" or account recovery flow, ideally from a device and location you've used before, since some services weigh that during verification.
If the recovery email or phone was also changed, look for the provider's account recovery form or support page. Expect identity checks and possibly a wait of a few days. Be wary of anyone online offering to "recover" your account for a fee, as these are frequently scams.
When the problem goes beyond a password
If the compromised account was tied to money or identity, take extra steps:
- Contact your bank or card issuer if you see unfamiliar transactions, and ask about replacing affected cards.
- Consider a credit freeze or fraud alert if personal details like your national ID number may have been exposed. Availability and procedures depend on your country.
- Warn contacts if the account sent messages in your name, so they don't click suspicious links.
- Report the compromise through the service's own reporting tools.
Common mistakes to avoid
- Changing the password on a possibly infected device, which can expose the new one.
- Reusing the new password on another account "just this once."
- Skipping the session sign-out, leaving an intruder logged in.
- Storing passwords in notes apps or screenshots that sync to an account that might itself be compromised.
- Ignoring the email account while fixing everything else.
What to do next
If you do only three things today, secure your email, make every important password unique, and turn on two-step verification. Over the following days, move through your remaining accounts as time allows and keep an eye on login alerts and bank statements for a few weeks. If you're locked out, money is involved, or you suspect your device itself is infected, go to the service's official support or your bank rather than trying to fix it alone.