How to Check If a Password Has Been Leaked (And What to Do Next)

The email usually arrives at the worst moment: your password was found in a data breach. It sounds like someone is already inside your account, so the instinct is to panic, or to ignore it and hope it goes away. Neither reaction helps, because a leaked password is a warning, not a break-in, and what you do in the next hour decides whether it becomes one.

This guide explains how to check a password safely, what a breach result actually means, and the order to reset things in so the important accounts get protected first. No special software is needed, and you will never be asked to type your password into a site you do not trust.

What leaked actually means

A data breach is a leak from a company's database, not a break-in to your personal account. When a shopping site, forum, or app is breached, the attackers copy its user records, which often include email addresses and passwords, and those records sometimes end up shared or sold online. Your password being in that pile means it is now known to strangers, not that someone has logged in as you.

That distinction matters because it changes the job. You are not chasing an intruder out of your account; you are retiring a password that is no longer secret before anyone tries it. A password that appears in breach data should be treated as public, because attackers test leaked passwords against many sites automatically.

Check the password without handing it over

The safest way to check a password is the free Have I Been Pwned Pwned Passwords service, which is built so your password never leaves your device in full. It works by a method called k-anonymity: your browser turns the password into a scrambled fingerprint, sends only the first five characters of that fingerprint, and receives back a list of matching fingerprints to compare locally. The service never sees your password, and it never sees the full fingerprint either.

If the result says the password has been seen in a breach, stop using it everywhere, not just on the site named in the alert. If the result says it has not been seen, that is good news with a limit: it only means this password has not turned up in the breach collections that service knows about. It is not proof the password is strong, and it is not a reason to reuse it on ten sites.

Check the email address too

Checking the password answers one question, but checking your email address answers a bigger one: which breaches actually exposed you. The same service lets you search an email address and lists the breaches it appeared in, along with what kind of data each breach included, such as passwords, phone numbers, or addresses. That list tells you whether you are dealing with one old forum leak or a pattern of exposures.

Work through that list account by account. For every breach that included a password, assume the password from that time is burned, even if you changed it later on that one site, because the old password may still open other accounts where you reused it. Your phone or browser's built-in password check is a useful second pair of eyes.

The reset order that actually protects you

Reset in the order an attacker would attack, not in alphabetical order. First, your email account, because email is the reset key for almost everything else: anyone who controls your inbox can request password resets for your other accounts. Change the email password to something new and unique, and turn on two-factor authentication there before moving on.

Second, your money: banks, payment apps, and any shopping account with a saved card. Third, work and school accounts, which often hold sensitive documents and contact lists. Fourth, everything else that reused the leaked password, starting with social media and ending with low-stakes accounts like forums. If an account offers a sign-out-everywhere option, use it after changing the password, so any session the old password opened is closed.

A worked example: one reused password, five accounts

Say you used the same password for a shopping site, your email, a streaming service, a social media account, and a forum. The shopping site is breached, and a breach alert names that password. The shopping account is the least of your problems, because the same password also opens your email, and your email can reset the rest.

The fix follows the order above. Change the email password first, and turn on two-factor authentication, so the email can no longer be used as a master key. Then change the bank-linked shopping account, then the social media account, then the streaming service, then the forum, giving each a different password. Five changes sound like a lot, but each one closes a door the breach opened, and the email change alone protects every account that resets through it.

Build a replacement that sticks

A replacement password has to be both new and memorable, or you will drift back to reusing it. A passphrase of four unrelated words, such as a colour, an animal, a food, and a place, is easier to remember than a random string and much harder to guess than a single word with a number on the end. Do not build it from your name, your birthday, your team, or your pet, because those are the first things an attacker tries.

If remembering many different passwords feels impossible, that is exactly what a password manager is for: it stores a unique password for every site, so you only have to remember one strong master password. The free password generator at the end of this guide creates a replacement in seconds, and the guide on creating a strong password explains the passphrase method in full, so you can build one you will actually keep.

Turn on the locks that make a leak less dangerous

A leaked password is far less dangerous when the account needs a second proof of identity. Turn on two-factor authentication wherever it is offered, and prefer an authenticator app over a text-message code, because text codes can be intercepted while app codes are generated on your own device. Where a site offers passkeys, which let you sign in with your phone or fingerprint instead of a typed password, use them: there is no password to leak at all.

Two smaller habits help just as much. Review the signed-in devices on your important accounts once in a while, and sign out any device you do not recognise. Turn on login alerts, so you hear about a new sign-in the same day, not weeks later.

What not to do after a leak

Do not pay a service that promises to remove your data from breach lists, because breach data is copied too widely for any one company to delete, and the payment itself hands your details to a stranger. Do not click links inside a breach-alert email without checking where they lead, because fake breach alerts are a common phishing trick; go to the service or the site directly instead.

Do not just add a digit or an exclamation mark to the leaked password and keep using it, because attackers automatically try those small variations first. Do not type the password into a random checker site that appears in search results, since a site like that could simply be collecting passwords. Check with a known service, change the password, and move on.

Check, then replace it

Once you have retired the leaked password, make its replacement with the free password generator and keep it unique to that one account. For the full method behind a memorable, strong password, read how to create a strong password you can actually remember.

Frequently asked questions