A leaked password is only dangerous if you keep using it. Most people discover their password has leaked long after the leak actually happened, because a data breach at one website can quietly expose login details that then circulate online for years.
The good news is that checking takes only a few minutes, and a leaked password is not a disaster if you act on it quickly, starting with the accounts that matter most.
This guide shows you how to check whether your email address or a specific password appears in a known breach, how to read the results correctly, and exactly what to do next in the right order.
What a Leaked Password Actually Means
A password leak happens when a company that stores your login details suffers a data breach, and the stolen information ends up in a database that attackers can buy, trade, or download.
Sometimes only email addresses are exposed, which is annoying but not immediately dangerous, while other breaches expose passwords too, and those are the ones that need urgent action.
Passwords in a breach may be stored in plain text, scrambled with weak protection, or protected with strong hashing, and security researchers generally treat any password found in breach data as burned.
The real danger is reuse. If the same password unlocks your email, your bank, and your social media accounts, then one leak effectively hands an attacker the keys to all of them at once.
Attackers also automate this process with a technique called credential stuffing, where stolen email and password pairs are tried automatically against hundreds of popular websites.
That is why a breach at a forum you barely remember can still threaten your main accounts, and why the fix is never just changing the password on the breached site alone.
Step 1: Check Your Email Address on Have I Been Pwned
Have I Been Pwned is a free breach lookup service created by Australian security researcher Troy Hunt and launched in December 2013, and it is widely used by security teams and journalists.
To use it, type haveibeenpwned.com into your browser yourself rather than clicking a link in an email, then enter one email address and click the check button.
The site compares your address against verified breach data and lists every breach it appears in, along with when the breach happened and which types of data were exposed.
Repeat the check for every email address you use, including old addresses that are still linked to shopping, banking, or social media accounts you care about.
A result that says your address was found does not automatically mean your current password was exposed, so read the details of each breach before deciding how urgently to act.
The site also offers a free Notify Me option that emails you if your address appears in a future breach, which is a simple way to catch new leaks without remembering to check.
Step 2: Check the Password Itself With Pwned Passwords
Have I Been Pwned also runs a separate tool called Pwned Passwords, which checks whether a specific password has appeared in known breach data rather than checking an email address.
Its design protects your privacy through a technique called k-anonymity: your password is hashed in your browser, and only the first five characters of that hash are sent to the service.
The service returns a list of matching hash fragments, your browser compares them locally, and your full password never leaves your device during the check.
If the tool reports that a password has been seen in breaches, stop using that password everywhere immediately, even if you cannot remember which breach exposed it.
Never type a real password into a random password checker website, a social media quiz, or a link sent by email, because only the official tool and your own password manager deserve that trust.
As a rule, only ever type a password into the website or app that the password actually belongs to, and treat every other request for it as suspicious by default.
Step 3: Let Your Browser or Password Manager Check for You
If you save passwords in your browser or a password manager, its built-in security check can scan your whole collection at once and flag compromised, reused, and weak passwords together.
In Google Chrome, open Settings, go to Autofill and then Password Manager, and run the Checkup feature, which also covers passwords saved to your Google Account.
On an iPhone or Mac, open Settings and then Passwords, and look at Security Recommendations, where iCloud Keychain flags passwords that appear in known data leaks.
Standalone password managers such as 1Password and Bitwarden offer similar breach and health reports, often called Watchtower or Vault Health Reports depending on the app.
These built-in checks are the fastest way to find reuse, because they compare your saved logins against each other instead of asking you to remember every account you own.
Work through the flagged list in priority order rather than alphabetically, starting with email, banking, and any account tied to payments or your identity.
What to Do First If Your Password Has Leaked
Secure your email account first. Your email account is the master key to almost everything else, because password reset links for your other accounts are sent there.
Change its password to a long, unique one you have never used anywhere else, and turn on two-factor authentication before you change anything else.
If you cannot sign in to your email at all, use the provider's account recovery process immediately and check its recent sign-in activity for sessions you do not recognise.
Change the leaked password everywhere you reused it. Do not just change it on the breached website, because attackers will try the same combination on your email, your bank, and your social media accounts.
Open each account from its official website or app, change the password to a unique one, and sign out of other sessions if the account offers that option.
Start with money and identity accounts, then email and cloud storage, and finally forums, shopping, and entertainment accounts that share the same password.
Turn on two-factor authentication everywhere it is offered. Two-factor authentication means a stolen password alone is no longer enough to sign in, because the attacker also needs a code or a device you control.
An authenticator app or a hardware security key is stronger than a text message code, which can be intercepted if an attacker hijacks your phone number.
Save the backup or recovery codes each service gives you somewhere safe, because losing your second factor can lock you out of your own account.
Check for signs that someone already used the leak. Look for password reset emails you did not request, unfamiliar sign-in alerts, new devices on your accounts, and messages sent from your accounts that you did not write.
Review recent transactions on banking and shopping accounts, and check whether your email forwarding rules or recovery address have been changed without your knowledge.
If you find unauthorised activity, report it to the service straight away, change the password again from a clean device, and keep a record of what you found.
Switch important accounts to passkeys where available. Passkeys replace passwords with a cryptographic key stored on your device and unlocked with your fingerprint, face, or device PIN.
Because there is no password to leak, reuse, or phish, a passkey cannot be stolen in a password database breach in the same way.
Google, Apple, and Microsoft accounts all support passkeys, and many major banks and social platforms now offer them as a sign-in option alongside passwords.
If Sensitive Personal Data Leaked Too
Some breaches expose more than passwords, such as phone numbers, home addresses, dates of birth, or identity document details, and those need a different kind of response.
Watch carefully for phishing messages after a breach like this, because scammers use leaked personal details to make fake emails and texts look convincingly real.
Be especially suspicious of any message that pressures you to act urgently, asks you to click a link, or claims your account will be closed if you do not respond.
In the United States, you can place a credit freeze for free with each of the three major bureaus, Equifax, Experian, and TransUnion, which blocks new credit from being opened in your name.
A freeze does not affect your credit score, lasts until you lift it, and must be placed separately with each bureau, while a fraud alert is a lighter alternative that lasts one year.
If you live outside the United States, check your local credit reporting agency and your bank for equivalent fraud monitoring and identity protection services.
How to Build Passwords That Survive the Next Breach
The single most important habit is never reusing a password, because a unique password turns any future breach into a problem for one account instead of all of them.
A password manager makes this realistic by generating and storing a different long, random password for every site, so you only need to remember one strong master password.
If you prefer memorable passwords, use a passphrase of several unrelated words, such as a short sentence only you would invent, and add numbers or symbols to reach a good length.
Length matters more than complexity tricks: a long password made of ordinary words is generally far harder to crack than a short one stuffed with symbols.
Finally, keep your password manager itself protected with a strong master password and two-factor authentication, and store its recovery key somewhere safe and offline.
Frequently Asked Questions
Does a leaked password mean someone has hacked my account?
Not necessarily. A leaked password means your login details appeared in breach data that attackers could use, but it does not prove that anyone has actually signed in to your account.
Treat it as an urgent warning rather than a confirmed break-in, change the password anyway, and check the account's sign-in history for activity you do not recognise.
Is it safe to type my email into Have I Been Pwned?
Yes. The service checks your address against breach data that is already circulating, does not ask for your passwords, and is run by a well-known security researcher.
Type the address yourself into haveibeenpwned.com rather than following a link in an email, and never enter a password on any site except the one it belongs to.
Should I change my password if the check shows nothing?
A clean result is good news, but it is not a guarantee, because new breaches are discovered regularly and it takes time for breach data to be verified and loaded.
You do not need to change a strong, unique password just because of a clean result, but you should still use a different password for every account and turn on two-factor authentication.
How often should I check for leaked passwords?
Checking every few months is reasonable for a manual check, and enabling breach alerts or using a password manager with built-in monitoring means you will be warned automatically.
Run a fresh check immediately after you hear about a breach at a service you use, and again after any suspicious sign-in alert or unexpected password reset email.
A leaked password feels alarming, but it is one of the most fixable security problems you can face, because the damage only happens if the password stays in use.
Check your addresses, change the leaked password everywhere it was reused, secure your email first, and turn on two-factor authentication, and you will have closed the gap before most attackers get around to trying it.