How to check if your email or password was in a data breach

A data breach checker answers one narrow question: has this email address, or this password, shown up in data that leaked from a past breach? That is useful. It is also easy to over-read.

This guide explains how breach checkers work, what the result means in each direction, which tools are worth using, and what to do in what order if your email turns up. It also covers a trap that catches a lot of people after a breach: the fake "your data was exposed" email.

How a data breach checker works

When a company is hacked, or when it leaves a database exposed to the internet, copies of that data often end up in the hands of other people. Some of it gets posted publicly. Some of it gets traded or sold. Researchers and volunteers collect many of these dumps.

A breach checker is a searchable index built from that collected data. You type in an email address. The tool looks it up and tells you which known breaches included it, and usually what kinds of data were in them, such as email addresses, passwords, names, or phone numbers.

Two things follow from this.

First, a checker can only report on breaches it knows about. If a breach was never made public, never reached the people who collect this data, or hasn't been added yet, the checker can't see it.

Second, a checker doesn't go out and look at your accounts. It isn't scanning your email inbox or testing your logins. It compares what you typed with a list.

Have I Been Pwned (often shortened to HIBP) is the best-known example. According to its About page, it is a free resource for anyone to quickly assess if they may have been put at risk by a data breach. The site says all of its data comes from breaches in which information was exposed to people who should not have been able to see it. Troy Hunt created it and writes that he has run it since 2013, after the Adobe breach.

Check your email address, step by step

You can do a basic check in a few minutes.

1. Go to haveibeenpwned.com and type your email address into the search box. Type the address yourself rather than following a link from an email or text.
2. Read the list of breaches. Each one shows the name of the service, the date, and the types of data that were exposed.
3. Note which of your accounts those services correspond to. Some may be sites you forgot you ever signed up for.
4. Repeat for every email address you use, including old ones and any you used only for shopping or newsletters.

On privacy, the HIBP FAQs state that searches are not logged. They also say no password is stored next to any personally identifiable data. That is the site's own description of how it works. You should still only type your email address into services you have a reason to trust, and the sections below explain how to protect your passwords specifically.

One more detail from the FAQs: some breaches are marked sensitive. HIBP says these can't be searched publicly. Only the verified owner of an email address can see them. To verify, you sign in to the dashboard and confirm that you have access to the address through an email sent to it. The FAQs list 90 sensitive breaches, with examples such as Ashley Madison and Adult FriendFinder. If your email address is in one of these, a public search won't show it, which is one more reason a quick search isn't the whole story.

What the result tells you, and what it doesn't

Let's take the two outcomes in turn.

If your email appears

It means that address was in the data from at least one known breach. It does not mean someone is using your accounts right now. It does mean the address, and possibly other data tied to it, has been out of the company's hands.

The useful details are in the data types. An email address alone is a smaller problem than an email address plus a password. A leaked email address mostly means more spam and more convincing phishing attempts. A leaked password that you reused elsewhere is a much bigger problem.

If your email doesn't appear

Don't read this as an all-clear. The HIBP FAQs address this directly: a clean result does not mean you're safe. The page says "absence of evidence is not evidence of absence." HIBP holds only a subset of breached records, and some breaches go undetected.

A clean result might mean any of these:

• Your address wasn't in any breach the tool knows about.
• It was in a breach that hasn't been found or added yet.
• It was in a sensitive breach that a public search doesn't show.
• You typed a different address than the one you used when you signed up.

An empty result is one useful data point. Keep your passwords unique and your accounts protected regardless.

What a checker can't tell you

A breach checker doesn't tell you whether your information is for sale on a people-search site, whether a data broker has your home address, or what a web search about your name returns. Those are different problems with different sources. A breach checker only looks at leaked data.

Pwned Passwords: checking a password without exposing it

HIBP has a second tool, Pwned Passwords, that checks a password instead of an email address. According to the HIBP FAQs, a password found there has appeared in a data breach. The FAQs add that a pwned password should no longer be used.

The obvious worry is that you'd be typing a real password into a website. Here is how HIBP says it handles that. On the Pwned Passwords page, the site says your password is hashed in your browser using SHA-1, and that only the first five characters of that hash are sent to its API. The server returns a list of matching hash suffixes, and the final comparison happens on your side. The page says this happens without sending the full password or its complete hash to the service.

That design means the check can be done without handing over the password. It is still a good habit to treat a password you type into any website as sensitive, which brings us to the next section.

HIBP also says a clean result doesn't necessarily mean it's a good password, merely that it's not indexed on the site. A short, guessable password can come back clean and still be easy to crack.

Never type your real password into a site you don't know

Plenty of "free password checkers" exist. Some are legitimate. Some exist to collect passwords. From the outside, you often can't tell the difference.

A few rules keep you safe:

• Don't type a current password into an unfamiliar site. If a tool asks for the password you use on your bank, your email, or your phone account, stop. Your email address is enough for most breach lookups.
• Prefer tools that check on your device. The Pwned Passwords design described above, and the checks built into Google and Apple products described below, are built so the full password isn't sent in the clear.
• Check the address before you type. Make sure the web address is the real one. Don't follow a link from a message to reach a checker. Open your browser and type the address yourself.
• Watch for tools that ask for more than they need. A breach lookup shouldn't need your Social Security number, your date of birth, or a payment card. That kind of request is a red flag worth treating with suspicion.

If you've already typed a real password into a site you now doubt, change that password right away, and change it anywhere else you used it.

Checkers built into your browser and phone

You may already have a leak check running in the background. Two of the most common are worth knowing.

Google Password Checkup

Google's help page says Password Checkup looks at whether passwords in your Google Account are exposed, weak, or used in multiple accounts. To run it in Chrome on a computer, Google says to select More, then "Passwords and autofill," then "Google Password Manager," and then "Checkup" on the left. In another browser, you can go to passwords.google.com, select "Go to Password Checkup," and then "Check passwords." You may need to sign in.

Google describes the results this way. Compromised passwords are ones whose combination has been published online, and Google recommends changing them as soon as possible. Reused passwords raise the risk of being hacked, so Google recommends a unique password for each account. Weak passwords, such as those with obvious phrases or simple keyboard patterns, can be easily guessed.

Google also says it can notify you when it finds your saved passwords online. You can turn "Password alerts" on or off in the settings at passwords.google.com.

Apple's Passwords app

Apple's support page for the Passwords app has a section called "Security recommendations in Passwords." Apple says that if your device identifies common weaknesses in your passwords, Passwords alerts you and recommends that you update them. It also says Passwords alerts you if your passwords appear in known data leaks. To review them, you choose Security in Passwords and select an account with a weak or compromised password.

On privacy, Apple's passwords and privacy page says Apple sends your device a list of common passwords that are present in data leaks. For other passwords, it says Passwords sends information calculated from your passwords to Apple to check for a possible leak. Apple states that your actual passwords are never shared with Apple and that Apple does not store the information calculated from your passwords. The same page says you can turn the feature off in Settings > Apps > Passwords > Detect Compromised Passwords.

The limits of built-in checks

These checks only cover passwords you have saved in that password manager. If you keep some passwords in your head, in a notes app, or in a different manager, they aren't being checked. They also look at passwords, not at whether your email address or other details were exposed. Using a built-in check and an email lookup together gives you a wider view than either one alone.

A compromised-password warning means the password appeared in leaked data. It usually points to a breach at a website or app, not a virus on your phone. Treat the warning as a reason to change the password, not as proof that someone has broken into your device.

Our free scan and leaked passwords

Our free scan runs the same kind of check as the tools above. It queries Have I Been Pwned and LeakCheck for known leaks tied to your email address. If a password turns up in what those sources return, the report shows it masked, so most of the characters are hidden. It does not show the full password. The scan doesn't require an account.

We can't tell you ahead of time what it will find. It depends entirely on what those sources know about your address, and as the section above explains, a report with nothing in it doesn't mean you're in the clear. The scan is one way to look. It isn't a replacement for strong, unique passwords and multi-factor authentication.

What to do if your email shows up in a breach

Work through these steps in order. The first few matter most.

1. Find out what was exposed

Open the breach details. Look for the data types listed. The advice below changes depending on whether it was just an email address, an email address with a password, or something more sensitive such as a Social Security number or financial details.

2. Change the password on that account

If the breached service is one you still use, sign in (by typing the address yourself) and change the password. Make it long and unique. CISA advises passwords of at least 16 characters and says to use a different strong password for each account.

3. Change it everywhere you reused it

This is the step people skip. CISA's page describes a case where a password that appeared in a company breach posted online had also been used on a second account, and both accounts were compromised. If you used the same password on other sites, attackers can try the leaked combination on those sites too. Change the reused password on every account that shared it, starting with your email, your bank, and anything that holds payment details.

4. Turn on multi-factor authentication

CISA advises turning on multifactor authentication (MFA) for every account or app that offers it. CISA explains that with MFA, a stolen password alone is not enough to get into an account. It suggests looking for the option in your account's security settings, where it may be called two-factor or two-step authentication, and picking a verification method the account offers, such as an authenticator app, a code sent by text or email, or biometrics. CISA suggests starting with email, because attackers who get into it can reset your other accounts.

5. Use a password manager

CISA recommends a password manager. It says these tools create and store passwords, fill them in automatically, flag weak or reused ones, and require you to remember only one strong password, the one for the manager itself. This makes it realistic to have a different password on every account.

6. Watch for the next breach

Have I Been Pwned's Notify me service signs your email address up for alerts. When your address appears in a new breach it adds, HIBP notifies you. You have to confirm your address through a verification link sent to your inbox before it starts. The HIBP FAQs add that notifications go only to the monitored address, so you can't monitor an address you can't access.

7. If a Social Security number or financial data was exposed

This is a different level of risk. Here the FTC's advice is to visit IdentityTheft.gov/databreach for steps that fit what was exposed. The FTC says that if your Social Security number was exposed, you should order your free credit reports and look for accounts you don't recognize. If the breached organization offers free services such as credit monitoring or identity theft insurance, the FTC says to take advantage of them.

The FTC also describes two tools to make it harder for someone to open credit in your name. A credit freeze blocks new credit accounts in your name, including ones you try to open yourself, until you lift it. A fraud alert tells businesses to check with you before opening new credit. The FTC says both are free. For a freeze, you contact all three credit bureaus (Equifax, Experian, and TransUnion). For a fraud alert, you contact one bureau, and it must notify the other two. The FTC says an initial fraud alert lasts one year and is renewable.

If you find that someone has used your information, the FTC says to report it at IdentityTheft.gov, which creates a recovery plan based on the type of information exposed.

None of these steps remove your data from the internet or undo the breach. They reduce what someone can do with what leaked. Be wary of anyone who promises to erase a leak.

The fake breach notification trap

After a well-publicized breach, scammers send their own messages. They look like an official notice. They say your account was compromised and that you must act now. They include a link to "secure your account" or "verify your identity."

The FTC's guidance on phishing describes how these messages look. They often appear to come from a company you know, such as a bank, a card issuer, a utility, or a payment service. They may claim suspicious activity or a payment problem. The FTC lists warning signs such as a generic greeting, a claim that your account is on hold, and an invitation to click a link to update payment details. It also notes that legitimate companies won't email or text a link to update your payment information.

Here is a simple way to handle any breach notice you didn't expect.

1. Don't click and don't open attachments. The FTC says links and attachments may install malware.
2. Ask whether you have an account with that company. If not, treat it as a scam, report it, and delete it.
3. If you do have an account, contact the company yourself. The FTC says to use a phone number or website you know is real, not the contact details in the message. Type the address in your browser, or use the app you already have.
4. Report it. Per the FTC, forward phishing emails to reportphishing@apwg.org, forward phishing texts to SPAM (7726), and report any phishing attempt to the FTC at ReportFraud.ftc.gov.

If you already responded, the FTC says that if your Social Security, credit card, or bank account number may be compromised, you should go to IdentityTheft.gov for steps based on what was lost. If you clicked a link or opened an attachment that may have installed harmful software, update your security software, run a scan, and remove anything it flags.

Real breach notices do exist. Companies often send them by mail or email. Even then, you rarely need to click anything. You can go to the company's real website by typing the address yourself and read the notice there.

Common mistakes to avoid

• Treating an empty result as a clean bill of health. As covered above, no checker sees every breach.
• Checking only one email address. Most people have several. Check each one.
• Changing one password and leaving the rest. The reused passwords are where the damage spreads.
• Choosing a new password that is a small variation on the old one. Adding a number to a leaked password is easy for an attacker to guess.
• Typing real passwords into random "checker" sites. Use trusted tools or the checks built into your password manager.
• Clicking the link in a "your account was breached" email. Go to the site yourself.
• Paying someone to "remove you from a leak." A leak is data that already left the company. Be skeptical of anyone who claims to fix that.

Where to report

Match the problem to the right place.

• A scam message you received: the FTC at ReportFraud.ftc.gov. Forward phishing emails to reportphishing@apwg.org and phishing texts to SPAM (7726).
• Someone used your personal information: IdentityTheft.gov, which the FTC says builds a recovery plan based on what was exposed.
• A breach at a company you do business with: start with the company's own notice and its official website, which you reach by typing the address yourself.

A simple routine to keep

You don't have to check every day. A short routine goes a long way.

1. Check each of your email addresses at Have I Been Pwned.
2. Run Google Password Checkup or review the Security section of Apple's Passwords app, whichever you use.
3. Sign up for Notify me on the addresses that matter most.
4. Make sure MFA is on for your email, bank, and any account that holds payment details.
5. Move to a password manager if you haven't, so each account has its own password.
6. Run a free scan like ours when you want a wider look that adds known leaks to what is visible about you on the public web.

If you do this once and set up alerts, you'll hear about the next breach faster. That's the realistic goal. You can't stop companies from being breached, but you can make sure a leak at one of them doesn't unlock the rest of your accounts.