If you are worried that a password has been exposed, two checks can help: see whether your email address appears in a known data breach, and check whether the password itself has appeared in leaked-password datasets. They answer different questions, so one result does not replace the other. The goal is to check safely, then act on anything that puts an account at risk.
Why passwords get exposed
Passwords can leak when a website or app suffers a data breach. They can also be stolen through phishing pages, malware, or reused across multiple services. Reuse is especially risky: if one service is breached, attackers may try the same email and password on email, shopping, social media, or financial accounts.
You cannot prevent every breach at a service you use, but you can reduce the damage by using a unique password for each account and turning on two-step verification where available.
Check whether your email address appeared in a breach
- Go to Have I Been Pwned at
haveibeenpwned.com. - Enter the email address associated with the accounts you want to check.
- Review the results to see which known breaches included that address and what types of data were exposed.
A match means your email address appeared in a breach record; it does not automatically prove that your current password was exposed. Check which service was involved and whether you still use that account. If the service is still relevant, change its password—especially if you reused it elsewhere. You can also enable breach notifications on the site so you can be alerted if your address appears in a future breach.
Check whether a password has appeared in known leaks
Have I Been Pwned also provides Pwned Passwords, a service that checks whether a password appears in its known dataset. It uses a technique called k-anonymity: the check sends only a small part of a password hash, not the full password or full hash. The service returns possible matches, and the comparison is completed on your device.
If a password is found, stop using it. Attackers often test known passwords against other accounts, even if the account you are checking was not part of the original breach. If it is not found, that is not proof it is safe; it may simply be absent from the dataset.
Never enter your real password into a random website, search engine, or unverified checker. Use established services that clearly explain their method, or use the security check built into a password manager or browser you already trust.
Use your browser or password manager’s security check
Many browsers and password managers can flag saved passwords that are weak, reused, or known to have appeared in breaches. The exact feature name and location vary by product, so look in its password or security settings for a password checkup or compromised-password alert.
This can be a convenient option because the tool checks passwords already saved in your existing software, rather than asking you to type each one into a separate website. Treat the results as a starting point: review any warning, replace exposed or reused passwords, and make sure the new passwords are unique.
If a password has leaked, secure accounts in this order
Do not just change the password on the service named in a breach notice. If you reused that password, other accounts may be exposed too. Work through these steps:
- Secure your email account. Email is often used to reset other passwords. If you suspect someone has access to it, change its password from a device you trust and review recovery details and recent sign-ins.
- Change the password on the affected service. Use a new, unique password that you have not used on another account.
- Change reused or similar passwords elsewhere. Prioritize important accounts such as banking, shopping, social media, and cloud storage. Do not simply change one character in the old password.
- Turn on two-step verification. Enable it for email and other important accounts. An authenticator app or security key is preferable where the service supports one.
- Review account activity. Check recent sign-ins, logged-in devices, recovery email addresses and phone numbers, and email forwarding rules. Remove anything you do not recognize and sign out other sessions if the service offers that option.
If you see unfamiliar activity on your email account, follow our guide to what to check when you think your email account was hacked. If you are locked out after changing phones or enabling two-step verification, our guide to recovering access when two-factor authentication stops working may help.
Choose stronger passwords going forward
- Use a password manager. Let it generate and store a long, random, unique password for each account.
- Use a passphrase when you need to memorize one. Choose several unrelated words rather than a familiar quote or personal detail.
- Use passkeys where available. They let you sign in without typing a conventional password and can reduce exposure to phishing.
A long password is not enough if it is reused. Uniqueness matters because it stops a leak on one service from automatically giving an attacker the same credentials for another.
Watch out for scams after a breach
News of a breach can trigger convincing phishing emails or text messages that pretend to come from the affected service. Do not follow a sign-in link just because a message says your account is in danger. Open the service using its official app or type its address yourself, then check for security alerts there.
What these checks cannot tell you
- Have I Been Pwned only includes breaches it has collected. A private or newly discovered leak may not appear.
- A result may refer to an old breach and a password you have already changed. Check the service and the date before deciding what remains at risk.
- Passwords stolen directly from your device by malware or captured on a phishing page may not appear in a breach database. If you suspect either, scan the device with trusted security software and change important passwords from a device you believe is clean.
A clean result is reassuring, but it is not a guarantee that your accounts have never been exposed. If you notice unfamiliar sign-ins, password-reset messages you did not request, or changes to account settings, investigate those signs even if a breach checker reports no match.
Make the next step count
Start by checking your email address on Have I Been Pwned and reviewing the password-security check in your browser or password manager. If you find an exposure, secure your email account, change the affected and reused passwords, enable two-step verification, and review recent account activity. Never share a password with an unfamiliar checker. A careful check followed by a few targeted changes is more useful than testing your credentials on multiple random websites.