How to Check If Your Password Has Been Leaked

Why this check matters

Data breaches happen continuously. Major companies with good security teams get breached; smaller sites with poor security get breached more often. In most cases, you will not receive a timely notification — or any notification at all. The credentials from that breach are sold in underground markets, compiled into aggregated lists like Rockyou2024, and tested against other sites in credential-stuffing attacks. By the time you hear about a breach in the news, your credentials may already be in use by attackers.

Checking whether your email address and passwords appear in known breach databases is one of the few ways to know proactively. It costs nothing and takes under a minute. If your credentials appear, you can act — change the password, enable MFA, check for unauthorised access — before an attacker does something with it.

Have I Been Pwned: the most comprehensive free tool

Have I Been Pwned (haveibeenpwned.com) is the authoritative public breach database, maintained by security researcher Troy Hunt. As of 2026 it contains well over 15 billion records from roughly a thousand breaches. To check your email address: go to haveibeenpwned.com, enter your email, press "pwned?". Within seconds, the site tells you which breaches your email appears in, when they occurred, and what data was exposed (email, passwords, physical addresses, phone numbers, etc.).

The site also has a password checker at haveibeenpwned.com/Passwords that checks whether a specific password appears in breach data. Importantly, this check uses a k-anonymity model: your password is hashed locally, only the first 5 characters of the hash are sent to the API, and the full hash comparison happens client-side. Your password never leaves your browser. This is safe to use.

What to do if your email appears in a breach

First: do not panic. Appearing in a breach database means your data was part of a leak, not that your account has been compromised right now. The required actions depend on what was exposed. If only your email was exposed (common in marketing list breaches), the main risk is increased spam and targeted phishing. Be more suspicious of emails asking you to click links or confirm credentials.

If your password was exposed: change the password on the breached site immediately. Then check whether you used the same or similar password on any other site — if so, change those too. This is why uniqueness matters: if the breached site has a unique password, the rest of your accounts are unaffected regardless of what the attacker does with it. If the breach exposed more personal data (physical address, payment information, social security numbers): monitor your credit, consider a credit freeze, be vigilant for identity theft attempts.

Setting up breach monitoring

Have I Been Pwned offers free email notification service. Register your email address and you will receive an alert whenever your address appears in a new breach. This is the best way to stay ahead: you are notified once a breach is added to the database, rather than finding out by chance. Mozilla Monitor (formerly Firefox Monitor) offers a similar free breach-alert service, built on Have I Been Pwned data. Both are free and well regarded.

Checking passwords without revealing them

The HIBP password API uses a k-anonymity model described above. You can also use it programmatically: hash your password with SHA-1, take the first 5 characters of the hash, and query api.pwnedpasswords.com/range/{first5chars}. The API returns all hash suffixes that match, along with breach counts. Compare the full hash against the returned list locally. If your password appears, change it regardless of the breach count — even one appearance means it is in circulation among attackers. This check is especially valuable for auditing passwords stored in a manager.

The ongoing practice

Check your primary email addresses on HIBP right now. Register for breach notifications. Use a password manager with built-in breach monitoring — Bitwarden (as a Premium feature), 1Password, and Dashlane all flag passwords that appear in breach databases. Set a calendar reminder to check quarterly. If you discover a breach, treat it as an opportunity: change the affected password, review adjacent accounts, and strengthen any remaining weak or reused passwords. The habit of monitoring is one of the highest-leverage security actions available to ordinary users.