Password leaked? What to do right now, step by step

You opened your browser or phone and saw a warning: this password has appeared in a data leak. It is an unpleasant moment. It is also one of the more useful warnings you will ever get, because it arrives before something bad happens, not after.

This guide explains what the alert means, what to do in the first hour, what to do over the next few days, and what to ignore. It uses the official help pages from Google, Apple, Microsoft and Mozilla for the alerts in their products, and advice from the FTC, CISA and Have I Been Pwned for everything else. Where a source does not say something, this guide does not say it either.

What a "password leaked" alert actually means

The alert has one core meaning: a password you use has shown up in a data breach, or in a list built from one. That makes it public information.

Microsoft puts it plainly for Edge. Any saved password flagged as compromised is now public information and should not be used. The same page says the flag does not mean the passwords stored in Edge were exposed in any way. The password leaked somewhere else, from some other app or website.

Microsoft also notes that the leak could have happened anytime, from just a few days earlier to several years ago. So the alert tells you about a password, not about an attack happening today.

Have I Been Pwned says the same thing about its own checker. A password that appears in its Pwned Passwords service has previously appeared in a data breach and should never be used. It also says that if you have used that password anywhere else, you should change it immediately.

Three points are worth keeping in mind.

First, an alert is not proof that someone logged in to your account. It is a reason to close the door before anyone tries it.

Second, the leak did not necessarily come from the site where you saw the warning. Firefox describes a "vulnerable password" as one that has been used on another account that was likely in a data breach, and warns that reusing credentials puts all your accounts at risk.

Third, changing the password does not undo the breach. Have I Been Pwned calls a breach listing an immutable historic fact. What you can do is make the leaked password useless.

What the alert looks like in each browser and on your phone

The wording differs, but the idea is the same. Here is what each company says about its own tool.

Chrome and Google Password Manager

Google's Password Checkup looks at whether your saved passwords are exposed, weak or used on more than one account. Google's help page says compromised passwords and username combinations are unsafe because they have been published online, and that you should change them as soon as possible.

To run the check in Chrome, Google says to select More, then Passwords and autofill, then Google Password Manager. On the left, select Checkup. In another browser, go to passwords.google.com, select Go to Password Checkup, then Check passwords. You may need to sign in.

Two details from the same page are useful. First, if you get an alert, go directly to Password Checkup instead of clicking a link in the notification. That way you know the alert is real. Second, you can dismiss a warning next to a password by selecting More, then Dismiss warning, and restore it later. Dismissing makes sense only when the warning no longer applies, for example when you closed the account. Do not dismiss it just to make the banner go away.

Google also says it may ask you to change your Google Account password if it might be unsafe, and that it keeps checking your passwords even if you turn alerts off.

iPhone, iPad and Safari

Apple's platform security guide explains that weak, reused and leaked passwords show up in a dedicated Security Recommendations interface on iOS, iPadOS and visionOS. A password is marked as leaked if the Password Monitoring feature can claim it has been present in a data leak.

Apple's personal safety guide gives the steps for iOS 17 and earlier. Go to Settings, then Passwords, then Security Recommendations. Turn on Detect Compromised Passwords. Review the recommendations for reused, weak or leaked passwords. Tap the flagged item and follow the onscreen instructions to update it. The menus may be arranged differently on newer versions of iOS, so if you cannot find these screens, look for the security section inside your Passwords settings or app.

Apple also says that if you sign in to a website in Safari with a saved password that is very weak or was exposed in a data leak, you are shown an alert strongly encouraging you to upgrade to an automatic strong password.

Microsoft Edge

Edge calls its tool Password Monitor. Microsoft says it can show a summary notification that appears only once each time a new password is found to be unsafe, with the choices "View details" or "Not now." If you dismiss it, a badge stays in the Settings menu showing how many passwords are compromised. You may also see an alert when you visit a website that has a saved password known to be unsafe.

In the Password security check, select Edit to go to the site and update the password. Select Dismiss warning if the entry no longer applies to you. Microsoft advises changing passwords immediately and starting with sensitive accounts such as email and banking.

Firefox

Firefox checks the date of a known website breach against the date you saved a password for that site. Mozilla says that if the website was breached after you saved your password, you will see an alert. The alert says the password may no longer be secure, and Firefox guides you to update it.

Mozilla says Firefox does this with secure, anonymous checks and never sends your saved passwords or login information to anyone, including Mozilla. Firefox also checks whether you reused any of the vulnerable passwords on other saved logins. If you turn off the breach alerts, you turn off that reuse check too, and Mozilla warns this reduces your online safety. So leave the setting on.

Mozilla also points to Mozilla Monitor as a free way to check whether your email address appeared in known breaches.

The first hour: what to do, in order

Order matters. Doing the right things in the wrong order wastes time. Here is a sequence that puts the highest-risk accounts first.

1. Do not click the link in the alert. Open the tool yourself

If the alert arrived as an email or text, do not use its link. Open your browser's password tool directly, as Google advises for Password Checkup. The FTC gives the same basic advice about any message that worries you. If you are unsure whether a message is real, contact the company using a phone number or website you already know is real, not the details in the message.

2. Change the leaked password on the site it belongs to

Go to the account that the alert points to and change the password there. Use a brand new password, not a small variation of the old one. If you used "Maple2024!" and you now switch to "Maple2025!", a person guessing from a leaked list has an easy job.

CISA's guidance for a new password is clear. Use a different strong password for each account. Make it at least 16 characters. A random string of mixed-case letters, numbers and symbols works, and so does a passphrase of 4 to 7 unrelated words. CISA also says a password manager can generate, store and even fill in all your passwords, and that built-in browser managers are one free option.

Let the password manager generate the new password. It is faster than inventing one, and it is less likely to be guessable.

3. Change that same password everywhere else you used it

This is the step people skip, and it is the one that matters most. Apple's platform security guide warns that using the same password for more than one service may leave those accounts vulnerable to a credential-stuffing attack. That is the term for taking a login that leaked from one place and trying it on other services.

Have I Been Pwned says reuse is widespread and puts your accounts at risk, because once one account is exposed, attackers can try the same login on others.

So think back. Where else did you type this password? If you are not sure, your password manager can help. Google's Password Checkup flags passwords used on multiple accounts. Apple lists reused passwords in Security Recommendations. Firefox runs a reuse check against your other saved logins. Use that list as your to-do list.

4. Start with email, then money, then everything else

If you have many accounts to fix, work in this order.

Your main email account comes first. The FTC calls email accounts the weak link in online security, because password resets for other accounts go to your email. Whoever controls your inbox can reset your other passwords.

Banking, credit card, payment and tax accounts come next. Microsoft also tells people to prioritize email and banking.

After that, change shopping accounts, social media, cloud storage, and anything that stores your address, phone number or payment details. Old accounts you no longer use can wait, but do not forget them. If an account is no longer needed, closing it is better than keeping a leaked login alive.

5. Turn on multi-factor authentication

Multi-factor authentication, or MFA, means using more than a password to get into an account. The FTC explains that MFA requires two or more credentials: something you know, something you have such as a one-time code or a security key, or something you are such as a fingerprint or face scan. It says MFA makes it harder for scammers to log in to your accounts even if they get your username and password.

CISA says to enable MFA especially for your email, social media and financial accounts. Start with those.

MFA does not replace a new password. It adds a second lock. Do both.

6. Check for sign-ins and settings you do not recognize

After changing the password, look at the account itself. Most large services have a page for recent activity, signed-in devices or security events. Look for devices, locations or times that do not look like you. Sign out of any session you do not recognize.

Also check the places an intruder would change first: the recovery email address, the recovery phone number, forwarding rules in your email, and linked apps. If any of those has changed and you did not change it, treat the account as taken over and use that service's account recovery process.

Google's help page mentions running a Security Checkup for your Google Account. It also says that for a Google Account with suspicious activity or that may have been hacked, there are separate recovery steps.

The next few days: finish the job

The first hour handles the immediate risk. These steps handle the rest.

Work through the full list of flagged passwords

Open your browser's check and clear every item, not only the one that triggered the alert. In Chrome, that is Checkup. In Edge, the Password security check. In Firefox, the saved logins with alerts. On iPhone, Security Recommendations. Leaked passwords come first. Reused and weak ones come after.

Leaked passwords are the sensible place to start, because they are already public.

Move to a password manager if you are not using one

CISA says that with a password manager you only need to remember one strong passphrase, the one for the manager itself. If you use a manager, the unique passwords stop being a burden. You also get a built-in way to see which ones are weak or reused.

CISA suggests checking reviews before you choose one, since some are free and others cost money.

Check where your email address has appeared

Have I Been Pwned lets you search an email address against known breaches. Its FAQ explains that a listing means your address was exposed in that incident. You may see breaches for services you never used, for reasons the site lists: data sold to another company, a service that changed its name, or someone else signing you up.

Remember the limits. The same page says that not finding your email does not prove you are safe, because Have I Been Pwned holds only a subset of breached records. It also notes that malware on infected machines collects stealer logs, which contain email addresses, passwords and the sites where they were entered.

Have I Been Pwned also says breaches that did not include passwords still matter, because they expose other personal information.

You can also sign up on that site for notifications if your address appears in a future breach. Notifications go only to a verified address.

Think about what else was in the breach

A password alert often hides a bigger question. If the breach also included your name, address, birth date or other identifiers, you have more to watch for than a login.

The FTC points people to IdentityTheft.gov/databreach for steps based on what information was exposed. In its alert about "dark web" emails, the FTC also suggests checking your credit reports at AnnualCreditReport.com for accounts you do not recognize, and says a credit freeze is free to place and remove. If you find an account you did not open, the FTC says to report it at IdentityTheft.gov to get a recovery plan.

You do not need to do all of that for every password alert. Do it when the breach involved more than a login, or when you see signs of misuse.

The email that quotes your old password

Many people get a password alert and an alarming email on the same day. That is not always a coincidence. Here is what the FTC says about it.

The FTC describes scam emails that claim the sender hacked into your computer and recorded you visiting adult websites. The message threatens to send the video to your contacts unless you pay in Bitcoin. The FTC says these threats are "all talk." The FTC says your email address was likely exposed in a data breach.

The unsettling part is that the scammers may really know one of your old or recent passwords. They include it to seem credible. The FTC's advice is short: stop, do not pay anything, delete the message, it is a scam. Update the password for the affected account and consider updating others too.

If one of these arrives, here is how to think about it.

The password in the email proves a breach, not a break-in. It came from a list. It does not show that anyone has access to your camera, your files or your accounts.

If the password is still in use anywhere, change it there, and wherever you reused it. If it is long out of use, you are done with that part. Then use the same checks as above for your current passwords, since a list that contains an old password may contain newer ones.

Do not reply. Do not pay. Report the email to the FTC at ReportFraud.ftc.gov. For phishing in general, the FTC says you can also forward the email to the Anti-Phishing Working Group at reportphishing@apwg.org.

If you have already paid and want to tell law enforcement, the FBI's Internet Crime Complaint Center at ic3.gov calls itself the central hub for reporting cyber-enabled crime. Its site says crimes against children should be reported to the National Center for Missing and Exploited Children instead. If someone is in immediate danger, call 911 or local police. IC3 also says it will never directly contact you for information or money, so treat any message claiming to be from IC3 with suspicion.

Common mistakes

Some mistakes come up again and again.

Changing only the one password in the alert. If you reused it, the other accounts are at risk too. The reuse list in your browser or password manager is the real to-do list.

Making a small change to the old password. A new password should have no obvious link to the old one. Let a manager generate it.

Clicking the link in a "security alert" message. Go to the tool or site yourself. Google specifically advises going directly to Password Checkup rather than clicking a link in the notification.

Dismissing the warning. Dismiss only when the entry no longer applies, such as an account you closed. Otherwise you hide a problem that is still there.

Turning off breach alerts because they are annoying. Mozilla warns that turning off Firefox's breach alerts also turns off the password reuse check. Alerts are the point of the feature.

Treating a clean check as a clean bill of health. Have I Been Pwned says a password that is not found is not necessarily a good password, only one that is not indexed on its site. Its email search also covers only a subset of breached records.

Skipping MFA because the new password feels strong. A strong password and MFA do different jobs. The FTC says MFA still helps when someone has your username and password.

Paying a blackmailer. The FTC says do not. Report the message instead.

Who to tell, and when

Most password alerts need no report to anyone. You change the password and move on. Some situations call for more.

If an email tries to scare you or collect money, report it to the FTC at ReportFraud.ftc.gov.

If you gave a scammer a password or other details, the FTC says to go to IdentityTheft.gov, where you will see the specific steps to take based on the information you lost.

If you clicked a link or opened an attachment in a suspicious message, the FTC says to update your security software, run a scan, and remove anything it identifies as a problem.

If you lost money or think a cyber-enabled crime took place, use the FBI's IC3 site at ic3.gov. If a child is involved, IC3 says to report to the National Center for Missing and Exploited Children instead. Do not rely on a message that claims to come from IC3.

If a service tells you your account was involved in a breach, follow the notice from that company. Contact the company through a website or phone number you already know is real.

Where a free scan fits

An alert in your browser covers the passwords you saved in that browser. It does not tell you about the passwords you never saved there, the older addresses you stopped using, or what a breach exposed besides the password.

That is where a wider check can help. A free scan can look up your email address against known breaches through Have I Been Pwned and LeakCheck, show any exposed passwords in a masked form, and list people-search sites that may display your details. It does not promise to find everything, and an empty result does not mean you are safe. It gives you a starting list of what to fix first. You do not need to create an account to run it.

A short checklist

Print this or keep it handy.

1. Open your browser or phone password check yourself. Do not use a link in a message.
2. Change the leaked password on its own site, with a new unique password of at least 16 characters.
3. Find every other account that used it and change those too, email first, then financial accounts.
4. Turn on multi-factor authentication for email, financial and social accounts.
5. Check recent sign-ins, recovery email and phone, and forwarding rules.
6. Clear the rest of your flagged list: leaked, then reused, then weak.
7. Do not respond to any email that quotes an old password and demands money. Report it at ReportFraud.ftc.gov.
8. If the breach exposed more than a login, follow the steps at IdentityTheft.gov/databreach.

You will not remove the breach from the past. You can make what leaked useless, which is the goal of everything above.