← All articles

How to Check If Your Password Has Been Leaked

Why You Should Check for Leaked Passwords

Data breaches happen constantly. In 2025 alone, over 3,200 publicly reported breaches exposed billions of credentials. Many more go unreported or undiscovered for months. The credentials from these breaches are aggregated, traded, and sold in underground marketplaces -- and then used in automated attacks against every major service.

The uncomfortable reality is that if you have been online for more than a few years, at least one of your passwords has almost certainly been exposed. The question is not whether you have been breached, but whether the passwords that were exposed are still in use anywhere.

Checking is free, fast, and something everyone should do periodically.

How to Check Using Have I Been Pwned

Have I Been Pwned (HIBP) is the most widely trusted breach-checking service. Created by security researcher Troy Hunt, it aggregates data from known breaches and lets you check whether your information was included.

Check Your Email Address

1. Go to haveibeenpwned.com.
2. Enter your email address.
3. The site shows which breaches included that email.

This tells you which services were breached, not what your password was. But if you used the same password on a breached service and any other account, that other account is at risk.

Check a Specific Password

HIBP also lets you check whether a specific password appears in any known breach database:

1. Go to haveibeenpwned.com/Passwords.
2. Enter the password you want to check.
3. The site tells you how many times that exact password has appeared in breaches.

Is this safe? Yes. HIBP uses a technique called k-anonymity. Your full password is never sent to their server. Instead, your browser hashes the password locally (using SHA-1), sends only the first 5 characters of the hash, and receives back all hash suffixes that match those 5 characters. The comparison happens locally in your browser. HIBP never sees your actual password.

If the password appears in their database, stop using it everywhere immediately.

Other Breach-Checking Tools

Google Password Checkup

If you use Google Chrome and save passwords in the browser, Google's built-in Password Checkup automatically flags saved credentials that appear in known breaches.

• Go to passwords.google.com.
• Click "Go to Password Checkup."
• Google compares your saved passwords against their breach database and identifies compromised, reused, and weak passwords.

Apple Passwords Security Recommendations

Apple devices check your saved passwords against known breach databases automatically:

• On iPhone/iPad: Settings > Passwords > Security Recommendations
• On Mac: System Settings > Passwords > Security Recommendations

Compromised passwords are flagged with a warning, and you can change them directly from the interface.

Password Manager Audits

Most password managers include breach-checking features:

• 1Password: Watchtower scans your vault against HIBP and flags compromised, weak, and reused passwords.
• Bitwarden: Vault Health Reports check for exposed, reused, and weak passwords.
• Dashlane: Dark Web Monitoring actively scans for your credentials in breach databases.

These tools are convenient because they check all your stored passwords at once rather than one at a time.

What to Do If Your Password Was Leaked

Finding your password in a breach database requires immediate action. Here is the priority order:

1. Change the Password Immediately

Replace the compromised password on every account where you used it. Do not modify the old password -- generate a completely new random one. A password that was "Summer2024!" becoming "Summer2026!" is trivially predictable. Use a password generator to create something truly random.

2. Check for Password Reuse

If you used the leaked password on multiple accounts, every one of those accounts is compromised. This is the most critical step: identify everywhere the password was reused and change each one to a unique random password.

This is where a password manager becomes essential. Going forward, every account should have its own unique password so that a single breach never cascades.

3. Enable Two-Factor Authentication

If 2FA was not already enabled on the affected accounts, turn it on now. Use an authenticator app (Google Authenticator, Authy, or your password manager's built-in TOTP) rather than SMS. This ensures that even if a password is compromised in a future breach, the attacker cannot access the account without your second factor.

4. Check Account Activity

Log into affected accounts and review recent activity:

• Look for logins from unfamiliar locations or devices.
• Check for changes to account settings (email address, phone number, recovery options).
• Review sent messages, transactions, or posts you did not make.
• Revoke any third-party app connections you do not recognize.

If you see unauthorized activity, follow the service's account recovery process and consider reporting the incident.

5. Monitor for Ongoing Exposure

Set up alerts so you are notified about future breaches:

• HIBP Notifications: Register your email at haveibeenpwned.com/NotifyMe to receive alerts when it appears in a new breach.
• Password manager monitoring: Enable breach monitoring in your password manager if it offers the feature.
• Credit monitoring: If financial accounts were involved, consider a credit monitoring service or freeze your credit with the major bureaus.

For a deeper look at the steps to take after a breach, read our guide on what to do when your password is leaked.

How Breach Databases Work

Understanding how leaked credentials are collected and used helps explain why checking matters.

When a service is breached, the stolen data typically follows this path:

1. Exfiltration. Attackers copy the database, which may contain emails, usernames, and password hashes (or occasionally plain-text passwords).
2. Cracking. If passwords were hashed, attackers run cracking tools to recover the plain-text passwords. Weak hashes (MD5, SHA-1 without salt) are cracked quickly. Strong hashes (bcrypt, Argon2) resist cracking for strong passwords.
3. Aggregation. Cracked credentials are combined with data from other breaches into massive collections. The largest known collection, "Collection #1-5," contained over 2.2 billion unique email/password pairs.
4. Distribution. These collections are sold on dark web marketplaces or shared freely on hacking forums.
5. Automated attacks. Attackers use the credentials in credential stuffing tools that automatically try each email/password pair across hundreds of popular services.

This entire pipeline can play out within days of an initial breach. The sooner you check and change compromised passwords, the smaller the window of vulnerability.

Building a Breach-Resistant Setup

The best defense against breaches is a setup that limits the damage any single breach can cause:

• Unique passwords for every account. A breach at one service affects only that service.
• Random generation. Passwords that were not derived from patterns or personal information cannot be guessed or cracked through rules.
• A password manager. The only practical way to maintain hundreds of unique random passwords.
• 2FA everywhere. A compromised password alone is not enough to access an account with 2FA enabled.
• Regular breach checks. Monthly checks using HIBP or your password manager's audit tools catch exposures early.

Conclusion

Checking for leaked passwords takes less than a minute and can prevent account takeovers, identity theft, and financial loss. Use Have I Been Pwned to check your email and passwords, change anything that has been exposed, and generate new unique passwords with our free password generator. Pair every account with two-factor authentication, and a breach at any single service becomes an inconvenience instead of a crisis.