To check if your password was leaked, search your email address on Have I Been Pwned (haveibeenpwned.com) to see which known breaches include it, and test individual passwords with its separate Pwned Passwords tool. If you appear in a breach, change that password and every account that shares it, turn on multifactor authentication and watch for phishing that uses your real details. This guide walks through each step and cites the sources behind it.
How do you check if your email was in a data breach?
Have I Been Pwned (HIBP) aggregates data from breaches so people can see where their details were exposed. You enter an email address and the site lists the breaches it appears in. The site is intended to be free for individuals checking their own exposure; the subscription requirement on its FAQ page applies to searching larger domains, not to personal lookups.
- Sensitive breaches are hidden from public searches. HIBP’s FAQ lists 90 sensitive breaches. Only the verified owner of an address can see them, by signing in to the dashboard and confirming an email sent to that address. If a public search shows nothing, signing in is the only way to check these.
- You can subscribe to alerts. HIBP can notify you if your address appears in a future breach. Notifications go only to the address being monitored, and you cannot monitor someone else’s address.
- A clean result is not a guarantee. It means the address is not in the breaches HIBP has loaded. It does not prove you were never exposed.
How do you check whether a specific password was leaked?
Pwned Passwords is a separate service from the same site. It checks whether a password has appeared in a breach. HIBP says every password is hashed with SHA-1 and that searches are anonymised before being sent. If a password shows up there, stop using it everywhere, even if no account of yours was named in a breach. Because the lookup is anonymised, HIBP’s design is meant to let you test a password without sending the full password to the site.
This matters because of how services should now judge passwords. NIST’s SP 800-63B says services should compare a new password against a blocklist of commonly used, expected or compromised passwords, and reject it if it matches, telling the user why. It also says services should force a password change when there is evidence the password has been compromised, and should not require changes on a timetable otherwise.
Which tool checks what?
| Tool | What it checks | What it cannot tell you |
|---|---|---|
| HIBP email search | Whether an email address appears in breaches the site has loaded | Whether a particular password you use was exposed, or whether anyone used it |
| HIBP sensitive breaches (signed in) | Breaches that are hidden from public search, for the verified owner of the address | Anything about addresses you do not control |
| Pwned Passwords | Whether a password has appeared in a breach | Which of your accounts used it |
| Password manager breach check | Varies by product; check its own documentation | Not covered by the sources we used |
Use the first three together: the email search tells you which services lost data, and Pwned Passwords tells you whether a password you still use is already in circulation.
What should you do if you were in a breach?
The FTC’s breach checklist (an October 2022 consumer alert, so check the agency’s site for updates) and CISA’s guidance agree on the core steps.
- Change the affected password right away, and change it on any other account where you used the same or a similar one.
- Make each new password long and unique. CISA recommends at least 16 characters, either random or a passphrase of four to seven unrelated words, and a different password for every account. The UK NCSC suggests three random words and a separate strong password for your email.
- Use a password manager. CISA notes people cannot realistically remember many unique passwords, so a manager that generates, stores and fills them in, and flags weak or reused ones, helps. Options run from free browser tools to paid products.
- Turn on multifactor authentication, especially for email, bank and healthcare accounts, as CISA advises. The FTC says it keeps an account protected even if the password is exposed.
- Find out what else was exposed. For US readers, the FTC points to IdentityTheft.gov/databreach, which gives steps depending on whether a password, Social Security number or bank information was involved. If someone is opening accounts or buying things in your name, report it there.
- Watch for phishing. After a breach, messages that use your real details may arrive. CISA’s guidance is not to click links or open attachments, and to verify with the company through a website or phone number you already know.
What if the leaked password is for your email account?
Treat it as the most urgent case. Your inbox can reset the passwords on your other accounts, which is why the NCSC’s top tips start with a strong, separate email password, and why CISA’s example of an email takeover ended with attackers reaching linked bank and retail accounts. Change the email password first, turn on MFA there, then work through banking and any account that shares the old password.
What does a breach listing not tell you?
A listing does not mean your accounts have been taken over, and it does not say which of your details the attackers used. It means your address was in a data set that was exposed. HIBP describes breaches as data inadvertently exposed in a vulnerable system and keeps the breached addresses linked to the sites they came from, so the listing tells you which service to deal with. If money or identity documents may be involved, contact your bank or the relevant authority.
How can you lower the damage from the next breach?
- Use a different password everywhere, so one leak opens one account, not many.
- Keep software updated; CISA says to install updates, especially for browsers and antivirus software, and to turn on automatic updates.
- Back up photos and key documents, as the NCSC advises, so account loss is not data loss.
For the wider checklist, read our guide to protecting yourself online. If you think a Windows PC may be infected, see how to scan it for malware.
FAQ
Is Have I Been Pwned free? The site is intended to be free for individuals checking their own exposure. Domain searches for larger domains need a subscription unless a breach is flagged as free.
Why does a search show nothing when I know I was breached? Sensitive breaches are not shown in public searches. Sign in as the verified owner of the address to see them.
How long should a new password be? CISA says at least 16 characters. NIST’s guidance sets a floor of 15 characters for passwords used alone and 8 when used alongside another factor.
Should I change passwords on a schedule? NIST says services should not require it, but should force a change if a password is compromised.
Sources
- Have I Been Pwned: FAQs
- FTC: Have you been affected by a data breach?
- NIST SP 800-63B-4
- CISA: Use strong passwords (archived)
- CISA: Turn on MFA (archived)
- CISA: Recognize and report phishing (archived)
- NCSC: Top tips for staying secure online
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
