How to Check If Your Password Was Leaked

The safest way to check for a leaked password is to use your trusted password manager's security check and a reputable breach-notification service. Do not type your current password into a random website that promises to search the dark web.

If you already know an account was breached, you do not need to prove your particular password appeared in a leak before acting. Open the service directly, change that password, and replace it anywhere else you used it.

Understand what a breach result means

A data breach can expose email addresses, passwords, phone numbers, purchase records, or other information. The details vary. An email address appearing in a breach does not automatically mean someone has the current password to your email account.

Likewise, a password warning may refer to an old password, an exposed password reused on another site, or a password found in a known collection. Read the warning carefully before deciding which account needs attention.

• Exposed email: Your address appeared in a known incident; check which other fields were involved.
• Compromised password: A saved password matches known exposed credentials or a known leaked password.
• Reused password: Multiple accounts share a secret, so a breach at one can threaten the others.
• Weak password: A password is easy to guess, even without evidence that it was leaked.

A clean search is not a guarantee. Breach databases cannot contain every private, undiscovered, or recent leak. Treat the result as one useful signal rather than a certificate of safety.

Run your password manager's security check

Start with the password manager you already use, not a browser extension promoted in a warning ad. Update your device and browser first, then open the manager directly. Menu labels can vary by software version and whether you use a personal or managed account.

iPhone and Mac

Open Apple's Passwords app and look for Security. On older supported software, password recommendations may be under Settings > Passwords > Security Recommendations. Review any compromised, reused, or weak entries, then use the service's official app or website to make changes.

Changing a saved entry inside a password manager does not itself change the website's password. Complete the website's password-change process first, then confirm the manager saved the replacement correctly.

Android and Chrome

Open Google Password Manager and choose Checkup or Password Checkup. In Chrome, start at Settings > Autofill and passwords > Google Password Manager. On Android, searching device Settings for “Password Manager” can be easier than navigating a manufacturer's customized menus.

Other established password managers offer similarly named security dashboards or watchlists. Some checks depend on your subscription or settings. Read the provider's privacy explanation if you want to understand how it checks passwords without revealing them in plain text.

Check your email against known breaches

Have I Been Pwned is an established service for checking whether an email address appears in its known breach records. Type the address yourself into the browser, and make sure the domain is correct before submitting information.

1. Enter the email address you want to check, not its password.
2. Read the list of incidents and the categories of exposed data.
3. Identify which affected services you still use.
4. Check those services' official notices for recommended actions.
5. Consider subscribing to breach notifications for an address you control.

Some sensitive records have additional visibility restrictions, and not every breach is searchable. A result can describe an incident from years ago rather than a fresh compromise. Avoid assuming that the date you discovered a listing is the date someone accessed your account.

You generally do not need to enter a Social Security number, pay a fee, or install remote-access software for a basic email breach check. Requests like those are a reason to stop and reassess the site.

Replace exposed and reused passwords

Prioritize your primary email, password manager, financial accounts, and any account storing payment information. If an exposed password was reused, each account using it needs its own replacement. Adding a number to the end is not a meaningful fix.

1. Open the affected service through a trusted bookmark or official app.
2. Go to its password or security settings and create a unique password.
3. Save the replacement in your password manager.
4. Review active sessions and sign out unfamiliar devices, or all other sessions when appropriate.
5. Check recovery phone numbers, email addresses, and connected apps for unauthorized changes.

The Password & Hash Generator can help you create a fresh password. Never paste an existing password into it to investigate a breach; generating a replacement and checking exposure are different tasks.

Enable two-factor authentication after changing the password. Our guide to turning on two-factor authentication everywhere covers choosing a method and keeping recovery access. Where supported, a passkey can also reduce the risk of password phishing.

Look for signs someone actually signed in

An exposed credential is a risk; an unfamiliar login or changed recovery address is stronger evidence of account misuse. Review security activity, sent messages, forwarding rules, purchase history, and payment changes. Location estimates can be inaccurate, so consider the device, time, and activity together.

If you cannot sign in, use the service's official account-recovery process. Do not hire someone who contacts you claiming they can hack your account back. For email-specific steps, follow what to do if your email account is hacked.

If financial information was involved, contact your bank through its official app or the number on your card. An exposed Social Security number calls for identity-theft precautions beyond password changes, potentially including credit freezes. Save genuine notices and records of suspicious activity without storing passwords in your incident notes.

Common mistakes that make things worse

A frightening email that quotes an old password may be an extortion attempt using previously leaked data. The quoted password is not proof that the sender controls your camera or current accounts. Do not pay or reply; secure any accounts still using it.

Avoid clicking a breach-alert link just because the message names a real company. Open the company independently and check its security notices. Criminals can exploit real breaches by sending fake reset messages at exactly the moment you expect legitimate ones.

Do not download a leaked database to search it yourself. Besides privacy and legal concerns, downloads can contain malware or unrelated files. Trusted checks and direct account reviews are safer and usually more useful.

Make the next leak less damaging

You cannot control every company's security, but you can limit the consequences of its mistakes. Use a different password for every account, keep breach alerts enabled, and protect important logins with a second factor. Then an incident at one service is less likely to become a problem everywhere.