How to change your passwords after a data breach, step by step

If a company told you your data was exposed, or you found your email in a breach, the most useful thing you can do today is change the right passwords in the right order. It takes less time than most people expect, and you do not have to do everything in one sitting.

This guide walks through the order of operations, how to build passwords that hold up, how to use the tools already built into your phone and browser, and what to do if you can't get into an account. It also covers the mistakes that undo the work, and who to tell when something has gone wrong.

One note first. Changing a password does not take your information back from whoever has it. It closes one door. That is still worth doing, and it is the part you control.

What a breach actually puts at risk

A breach can expose different things: names, addresses, phone numbers, Social Security numbers, card numbers, or login details. Passwords are the part you can fix yourself, fast.

The danger grows when you reuse a password. Have I Been Pwned explains that attackers automate login attempts using leaked credentials from other sites. If the same password protects your email and a shopping site, a breach at the shopping site can become a problem for your email.

CISA puts it bluntly: reusing a password, even a strong one, endangers your accounts just as much as using a weak password. One guess opens every account that shares it.

That is why the work after a breach is not just "change the password on the site that was hit." It is also "find everywhere else that password, or something close to it, is in use."

Before you start: set up a safe place to work

A few minutes of preparation prevents most of the common mistakes.

Use a device you trust. If you think malware could be on your computer, the FTC advises updating your security software, running a scan, and removing anything it flags before you start recovering accounts. Changing passwords on an infected machine can hand the new password straight to the attacker.

Go to sites yourself. Do not click a link in a message that says your account is at risk. CISA's phishing guidance says not to click any link or call any number in the message. Instead, find the company's contact details on its verified website or type the address yourself. Breaches produce a wave of fake "security alert" emails, and some of them are built to collect the new password you are about to create.

Pick your tool for storing passwords. You will be creating a lot of new passwords. Decide now whether you will use a password manager, your phone's built-in one, or your browser's. The next sections explain why this matters. Setting it up first means every new password goes straight into storage instead of onto a sticky note.

Make a short list. Write down the accounts you plan to change, with no passwords on it. A list of site names is fine. Cross them off as you go.

Which passwords to change first

Not every account carries the same risk. Work in this order.

1. Your email accounts

Start here. The FTC says to protect your email account with a strong password because password reset links usually go to your inbox. Whoever controls your email can often ask other sites to reset their passwords and read the links that arrive.

If you have more than one email address, change all of them. Pay special attention to the one you use for recovery on other accounts.

2. Financial accounts

Next come your bank, credit card, brokerage, and payment apps. Change the password, then look at recent activity. If you see anything you do not recognize, contact the institution using the number on the back of your card or on its official website.

If a Social Security number, credit card number, or bank account number was exposed, a password change is not enough. The FTC points people to IdentityTheft.gov for recovery steps based on what was lost.

3. Your phone carrier and your Apple, Google, or Microsoft account

These accounts sit behind a lot of other things. Your phone number often receives the codes that protect other accounts. Your Apple, Google, or Microsoft account may hold saved passwords, backups, photos, and payment methods.

4. Your password manager or browser password store

If you already use one, its master password deserves a fresh look. Make it long and unique, and never use it anywhere else. CISA notes that with a password manager you only need to remember one strong password, the one for the manager itself.

5. Any account that shared the exposed password

This is the step people skip. Think back: where else did you use that password, or a close variation such as the same word with a different number at the end? The FTC says that if a company tells you your password was exposed, you should change it right away, and change it on any other service where you reused it. Treating close variations the same way is sensible, since they are easy to guess.

If you cannot remember, a password manager's checkup tool (covered below) can find reused passwords for you.

6. Everything else, in order of how much it holds

Work through shopping sites, streaming services, social media, health portals, and utilities. Put accounts with saved payment cards or personal records ahead of accounts that hold little.

You do not have to finish in one day. Do the first five in an hour, then chip away at the rest over a week.

How to build a password that holds up

Official guidance differs a little on exact length, so here is what each source says.

The FTC says to aim for at least 12 characters. CISA recommends at least 16 characters and says longer is stronger. NIST's current guidelines set a floor for organizations: when a password is the only factor, a minimum of 15 characters.

The practical takeaway is to go long. If a site lets you use 16 characters or more, do.

Use a passphrase when you have to remember it

For the few passwords you must actually remember, such as your phone passcode, your computer login, and your password manager's master password, a passphrase is easier than a jumble of symbols. CISA suggests a memorable phrase of 4 to 7 unrelated words. The FTC adds that a passphrase works if the words are random, and that you should avoid common phrases, song lyrics, and movie quotes.

The key word is unrelated. A line from your favorite book is not random. Four words picked by chance are.

Do not bother with clever substitutions

Swapping an "a" for "@" does not help much. Attackers know the tricks. NIST's guidance says organizations should not impose composition rules such as requiring a mix of character types. Length and unpredictability do the work.

Make every password unique

CISA says to use a different strong password for each account. This is the single habit that limits the damage from any future breach. When one site leaks, only that one password is affected.

Skip the old advice about changing passwords every 90 days

You may have been told to rotate passwords on a schedule. NIST's current guidelines say organizations should not require periodic password changes. They should require a change when there is evidence the password has been compromised. A breach is that evidence. A calendar reminder is not.

Check new passwords against known breaches

NIST also says services should compare new passwords against a blocklist of commonly used, expected, or compromised passwords. Have I Been Pwned runs a free service called Pwned Passwords for this. According to the site, your password is hashed locally and only the first 5 characters of the SHA-1 hash are sent to its service. The site says a password that is not found "doesn't necessarily mean it's a good password," only that it isn't in its collection.

Let a password manager do the heavy lifting

Nobody can memorize dozens of long, unique passwords. A password manager does it for you. The FTC says a browser can generate a password for you, and that browsers and password managers can all save your passwords. CISA notes that with a password manager you only have to remember one strong password.

If you choose a third-party manager, the FTC advises checking expert reviews and making sure the password that protects the manager is itself strong.

You have three common options.

Your phone's built-in manager. On an iPhone, Apple's Passwords app is where you manage saved passwords. Apple says your iPhone automatically identifies known weaknesses, such as passwords that are easy to guess or used more than once, and can securely monitor your passwords and alert you if they appear in known data leaks.

Your browser's manager. Chrome and other browsers save and fill passwords. Google's Password Manager includes a tool called Password Checkup.

A dedicated app. A separate password manager works across devices and browsers. Check that it supports the devices you use.

Whichever you pick, the habit is the same: let it generate the password, save it, and fill it in. You never type it by hand.

Use the compromised-password alerts already on your devices

Your phone and browser can do a lot of the detective work for you. These steps use features the companies document in their own help pages.

On an iPhone

According to Apple, open the Passwords app and tap Security. If an account has a weak or compromised password, a message explains the problem. Tap the account, then tap Change Password and update it on the website or in the app.

Apple adds that if the site or app lets you use a passkey, or Sign in with Apple, instead, you can take advantage of those. If you are not offered that option, many accounts let the iPhone create a strong password automatically.

To control the monitoring, open Settings, tap Apps, then Passwords, and turn Detect Compromised Passwords on or off. Menus move between iOS versions, so if you cannot find it, search the Settings app.

If a flagged password belongs to a site or app that no longer exists, Apple says you can delete the account entry from your iPhone and iCloud Keychain.

In Chrome and Google Password Manager

Google says Password Checkup finds saved passwords that may be exposed, weak, or reused. In Chrome on a computer, select More at the top right, then Passwords and autofill, then Google Password Manager, and choose Checkup on the left. In another browser, go to passwords.google.com, select Go to Password Checkup, then Check passwords. You may need to sign in.

Google explains that compromised passwords and username combinations are unsafe because they have been published online. It recommends changing a compromised password as soon as you can.

You can also turn password alerts on or off at passwords.google.com under Settings. Google says it keeps checking even when alerts are off, though you may still get alerts for up to 48 hours after you turn them off.

On Microsoft accounts

If you know your current password, Microsoft says to go to account.microsoft.com/security and select Change password. For a forgotten password, the sign-in page has a "Forgotten your password?" link that sends a verification code to the email or phone number you choose.

Treat these alerts as a prompt, not a verdict

An alert is useful. A lack of alerts is not proof that everything is fine. These tools only know about passwords that have turned up in the sources they check. Change the passwords on your priority list whether or not a tool has flagged them.

Add a second lock: two-factor authentication and passkeys

A strong password helps. A strong password plus a second step helps much more. The FTC says two-factor authentication means a stolen password alone isn't enough to log in.

Turn on multifactor authentication

CISA says to turn on multifactor authentication (MFA) for every account or app that offers it. Its examples include banking, online purchases, social media, and email. Start with your email, your bank, and your phone account.

To find it, open the account's security settings, often under Account Settings, Profile, or Preferences, and look for two-factor or two-step authentication.

Know the difference between the methods

CISA lists three common types: a numeric code sent by text or email, an authenticator app that generates a new code every 30 seconds, and biometrics such as a fingerprint or face scan.

The FTC ranks them. It calls codes sent by text or email the least secure type of two-factor authentication, and says an authenticator app or a security key offers more protection if you have the option.

Consider passkeys

A passkey replaces the password for a given site. Apple explains that passkeys use the WebAuthn standard and public key cryptography. Your device creates a unique key pair for each account, and Apple says the server never learns the private key. Apple describes passkeys as resistant to phishing and always strong, with no shared secrets.

On Apple devices, Face ID or Touch ID can approve a passkey. Apple says passkeys sync across your devices through iCloud Keychain, which is end-to-end encrypted.

Not every site supports passkeys yet. When one offers it during a password change, it is worth trying. Keep a way to recover access in case you lose a device. Apple notes that you can set up an account recovery contact for this reason.

Fix your security questions and recovery options

Passwords are only one way in. Attackers also use the "forgot password" path.

Security questions. The FTC advises skipping questions whose answers can be found online or in public records, such as your zip code, birthplace, or mother's maiden name. If you can't avoid them, the FTC says to treat them like a password and use random, long answers. Store them in your password manager like any other secret.

Recovery email and phone. Make sure the recovery email address and phone number on each important account belong to you and that you can still reach them. The FTC lists this as a step after regaining a hacked account. It is good housekeeping before anything goes wrong.

Signed-in devices. Google's help pages tell you to review the devices signed in to your account and remove ones you do not recognize. Other providers offer similar lists.

If you are locked out of an account

Sometimes the password has already been changed by someone else. Do not panic, and do not use a link from an email or text that claims to help.

1. Clean your device first. The FTC says to update your security software, run a scan, delete any suspicious software it finds, and restart.
2. Use the provider's official recovery process. Go to the provider's website yourself. The FTC links to recovery instructions for providers such as Google, Microsoft, Facebook, Instagram, and Yahoo. Microsoft's flow, for example, sends a code to a verification email or phone number on file. Microsoft also states that its support agents can't send password reset links or change account details for you, so be wary of anyone who claims otherwise.
3. Once you are back in, change the password. Make it strong and unique.
4. Sign out of all devices. This kicks out anyone who is still logged in.
5. Turn on two-factor authentication.
6. Check recovery email addresses and phone numbers. Remove any you do not recognize.
7. Look for signs of access. The FTC suggests checking for email forwarding rules you did not create, messages in your sent and deleted folders that you did not write, and posts, messages, or new connections on social media you do not recognize.
8. Warn your contacts. The FTC advises telling them about the hack, asking them not to click links from you, and telling them to ignore requests for help or money.

Google adds that you should also check payment settings for unfamiliar charges and check Gmail for forwarding rules, filters, or delegates you did not set up.

If the provider cannot help and you cannot sign in, you may have to give up the account. That is painful, but it is better than leaving it half-recovered. Move anything important to a new account protected by a fresh password and two-factor authentication.

Common mistakes that undo the work

Changing only the site that was breached. The reused password is the problem. Fix every account that shared it.

Making a small tweak. Changing "Summer2025" to "Summer2026" is not a new password. Attackers try obvious variations first.

Reusing the new password. A fresh password that you then use on three sites is just a new reused password.

Saving passwords in an unprotected file. A notes file, spreadsheet, or email draft is easy to find if someone gets into your device or account. Use a password manager.

Clicking the "reset your password" link in a message. After a breach, scammers send fake alerts. CISA's guidance says to treat urgent language, requests for personal information, and lookalike addresses as warning signs. Go to the site yourself.

Skipping your email. Many people change the password on the breached site and leave their email alone. The email account is the key to the others.

Trusting a single check. A clean result in a breach checker proves nothing either way. Not being listed in a breach database does not mean your data was never exposed.

Using text codes and stopping there. If an authenticator app or security key is available, it is a stronger choice, according to the FTC.

Ignoring the other data. Passwords are one piece. If your Social Security number, card number, or bank account number was part of the breach, work through the recovery steps at IdentityTheft.gov as well.

Who to tell, and when

You do not need to report every password change. You should report some situations.

Phishing. The FTC says to report phishing to ReportFraud.ftc.gov. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and forward phishing texts to 7726 (SPAM). CISA also says to use the report button in your email program or the sender's profile, then delete the message without clicking attachments or links, including "unsubscribe" links.

Exposed Social Security, bank, or card numbers. The FTC says to go to IdentityTheft.gov for steps based on what was lost. The site lists a first step of checking, freezing, and monitoring your credit, then separate steps for each type of information that was lost, including Social Security numbers, passwords, card numbers, and bank accounts.

Cyber-enabled crime. The FBI runs the Internet Crime Complaint Center at ic3.gov. It describes itself as the central hub for reporting cyber-enabled crime, and says to file even if you are unsure whether your complaint qualifies. It also says it cannot respond directly to every submission.

Your bank or card issuer. If you see charges or transfers you did not make, call the number on your card or the official website right away.

The company that was breached. Check its official notice for what it says was exposed and what it offers. Use contact details from the company's real website, not from a message you received.

Your employer. If a work account is involved, tell your IT or security team before you change anything. Work accounts are often managed by an administrator.

A simple plan you can finish this week

If the list above feels long, here is a short version.

Today (about an hour). Change your email password. Turn on two-factor authentication for that email. Change your bank and card passwords. Turn on two-factor authentication there too.

This week. Set up a password manager or review your phone's built-in one. Run the Password Checkup or Security checkup. Change every flagged, weak, or reused password, starting with accounts that hold money or personal records.

This month. Replace the remaining reused passwords. Add passkeys where sites offer them. Review recovery emails and phone numbers. Delete old accounts you no longer use.

It also helps to find out what is already out there. A free scan can check the public web and known breaches for your email, so you know which accounts to prioritize. It cannot promise to find everything, and a clean result does not mean you are in the clear.

Keeping the habit

The goal is not a perfect setup. It is a setup where one leak stays small. Long, unique passwords stored in a manager, a second step on the accounts that matter, and a short list of recovery options will cover most of what goes wrong.

When the next breach notice arrives, you will know what to do: find the account, change the password, check where else it was used, and move on.