How to check if your password was leaked, and what to do about it

Have I Been Pwned is a free service run by security researcher Troy Hunt. It collects data from public breaches and lets you search by email address. Type your address and it lists every known breach that included it, with the date and what kind of data leaked: passwords, phone numbers, addresses, and so on.

• A result does not mean your account was hacked. It means a copy of your data from that site is circulating.
• Look at the "compromised data" for each breach. If passwords are listed, treat that password as known to criminals.
• Sign up for free notifications on the site so you hear about future breaches that include your address.

No result is good news, but it is not proof of safety. Plenty of breaches are never made public, and some only surface years later.

Have I Been Pwned also runs Pwned Passwords, a database of passwords seen in breaches. You can check whether a specific password appears, without the site ever learning what it is.

The method is called k-anonymity, and the idea is simple. Your browser turns the password into a long scrambled code called a hash, then sends only the first five characters of that code to the service. The service replies with every leaked password hash that starts with those five characters, often hundreds of them. Your own device then checks whether your full hash is in that list. The service sees five characters shared by many passwords, so it cannot tell which one you were checking.

Many password managers and browsers use this same approach behind the scenes. Typing a password into a random "is my password safe" website is a different matter: unless you know how it works, do not.

If you save passwords in a browser or password manager, it can check them all at once. You do not need to install anything.

On an iPhone with an older iOS version, the same checks are under Settings, then Passwords, then Security Recommendations. Mozilla Monitor was previously called Firefox Monitor; it works without Firefox. Other managers, including Proton Pass and Dashlane, have similar reports.

If you do not use a password manager yet, our password manager comparison covers free options. Running a check is much more useful once all your passwords are in one place.

Work through flagged passwords in order of what they protect, not alphabetically.

1. Email first. If your email password is flagged or reused, change it now. Your email resets everything else.
2. Then money. Banks, cards, PayPal, investment apps, shopping sites with saved cards.
3. Then everything that shares a reused password. A leaked password is dangerous mainly because of where else you used it. Change every copy, giving each site its own random password.
4. Turn on 2FA for each important account as you go. Our two-factor authentication guide covers which type to choose.
5. Check for signs of misuse. Look at recent login activity, forwarding rules in your email, and saved addresses and payment methods on shopping accounts.

Accounts you no longer use are worth deleting rather than updating, since each one is another copy of your data waiting for the next breach. If the breach involved more than a password, such as your Social Security number or card details, follow our guide to what to do after a data breach.

What not to bother with

You do not need to change a strong, unique password just because a reminder pops up every few months. Current US government guidance on passwords (from NIST) advises against forced periodic changes. Change a password when there is a reason: it leaked, it was reused, or it is weak.

Scammers know people are worried about breaches, so they send fake warnings. Common versions:

• An email that looks like it is from Microsoft, Google, Apple or your bank, saying your password was found in a breach and you must "verify" or "reset" it through a link. The link goes to a fake login page.
• A sextortion email that quotes one of your old passwords in the subject line and claims to have hacked your webcam. The password comes from an old breach list. The rest is invented. Do not pay; change that password if you still use it anywhere.
• A call or text offering to "secure your accounts" for a fee, or asking you to read back a code.

Genuine warnings exist too. Google, Apple and password managers do alert you inside their own apps. The test is whether you can see the same warning after logging in on your own. Report fake ones at ReportFraud.ftc.gov, and see our guide on how to spot phishing emails.