How to Check if Your Password Was Leaked in a Data Breach (2026 Guide)

Every year, billions of login credentials end up on the dark web, pasted on forums, or sold in bulk on criminal marketplaces. If you reuse passwords (and most people do), a single breach at a company you barely remember signing up for can unlock your email, bank account, and social profiles. The good news: you can check if your password was leaked in a data breach in under two minutes using free, trustworthy tools. This guide walks you through exactly how to do it safely, what to do if your credentials show up, and how to make sure future breaches don't hurt you.

What Does It Mean When a Password Is "Leaked"?

A leaked password is a credential (usually an email-and-password pair) that has been exposed publicly or sold privately after a company's database was stolen, misconfigured, or hacked. Once leaked, that combination is added to massive compilations that attackers use for credential stuffing: automatically trying the same email/password on hundreds of other sites.

Even if the original site was something trivial, like an old gaming forum or a defunct shopping site, attackers assume (correctly, most of the time) that people reuse passwords. A leaked 2016 LinkedIn password could still be unlocking someone's PayPal in 2026.

How Passwords End Up in Breach Databases

Direct hacks: Attackers breach a company and dump the user database.
Misconfigured cloud storage: Public S3 buckets or exposed MongoDB instances.
Phishing campaigns: Credentials harvested through fake login pages.
Malware (infostealers): Trojans that scrape saved browser passwords.
Insider leaks: Employees selling or dumping customer data.

How to Check if Your Password Was Leaked in a Data Breach

There are two safe ways to check: by email address (to see which breaches you're involved in) and by password (to see if the specific password appears anywhere in known leaks). You should never paste your password into a random website — only use tools that use k-anonymity or hash-based lookups so your actual password never leaves your device in plain text.

Step 1: Check Your Email on Have I Been Pwned

Go to haveibeenpwned.com.
Enter your primary email address and click "pwned?"
Review the list of breaches your email appears in, including the date and type of data exposed (passwords, phone numbers, addresses, etc.).
Repeat for every email you use — work, personal, old accounts.

Have I Been Pwned (HIBP), run by security researcher Troy Hunt, is the industry standard. It indexes over 13 billion compromised accounts from more than 700 breaches and is trusted by governments, browsers, and password managers worldwide.

Step 2: Check a Specific Password Safely

Visit the "Pwned Passwords" section of Have I Been Pwned.
Type the password you want to check.
The site uses k-anonymity: only the first 5 characters of the SHA-1 hash of your password are sent to the server. The rest of the matching is done in your browser.
If it shows a count (e.g., "This password has been seen 1,245,678 times"), stop using it immediately — everywhere.

A password that shows up even once in a breach database is burned. Attackers' dictionaries include every single leaked password, so "only once" still means it's one of the first things they'll try.

Step 3: Use Your Browser's Built-In Breach Monitor

Modern browsers have breach checking baked in:

Google Chrome / Google Password Manager: Go to passwords.google.com → Checkup. It flags compromised, reused, and weak passwords.
Apple Passwords (iCloud Keychain): Settings → Passwords → Security Recommendations.
Firefox Monitor: Built into Firefox accounts, powered by HIBP data.
Microsoft Edge: Settings → Profiles → Passwords → Password Monitor.

These tools automatically compare your saved logins against breach databases and alert you when a match appears. Enable them if you haven't already — they run in the background and cost nothing.

Step 4: Check with Your Password Manager

Dedicated password managers (1Password, Bitwarden, Dashlane, Proton Pass, Keeper) all include breach monitoring under names like "Watchtower," "Data Breach Scanner," or "Dark Web Monitoring." They continuously scan new breaches and notify you the moment one of your credentials appears.

Free Tools to Check for Leaked Passwords

Here's a quick comparison of the most trustworthy tools in 2026:

Tool	What It Checks	Cost	Privacy Method
Have I Been Pwned	Email + password	Free	k-anonymity hashing
Google Password Checkup	All saved passwords	Free	Encrypted hash lookup
Mozilla Monitor	Email + continuous alerts	Free / paid tier	Uses HIBP data
Apple Password Monitoring	iCloud Keychain entries	Free with Apple ID	On-device + private lookup
1Password Watchtower	Vault + 2FA + weak passwords	Paid ($2.99+/mo)	Encrypted vault scan
Bitwarden Reports	Vault + exposed passwords	Free (Premium $10/yr)	HIBP integration

Tools to Avoid

Not every "breach checker" is safe. Avoid any site that:

Asks you to type your password in plain text without explaining hashing.
Requires payment just to tell you if you're breached (details should be free).
Is unknown and has no reputable security researcher behind it.
Shows ads promising "dark web scans" for a one-time fee.

If a tool isn't HIBP, a major browser, or a well-known password manager, be skeptical.

What to Do If Your Password Has Been Leaked

Finding out you're in a breach is uncomfortable, but the fix is straightforward. Act in this order:

1. Change the Breached Password Immediately

Start with the account that was breached, then change it on every other site where you used the same password or a variant of it. Variants like "Password123!" and "Password124!" offer zero extra protection — attackers try the obvious modifications.

2. Enable Two-Factor Authentication (2FA)

Even if attackers have your password, 2FA stops them cold. Use an authenticator app (Aegis, Ente Auth, 2FAS, Authy) or a hardware key (YubiKey, Google Titan) rather than SMS, which is vulnerable to SIM swap attacks.

3. Audit Your Email Account First

Your email is the master key to every other account (because of password resets). If your email password was in the breach, change it before anything else and review:

Login history and active sessions
Forwarding rules (attackers often add silent forwards)
Linked apps and third-party access
Recovery phone numbers and backup emails

4. Move to Unique Passwords Everywhere

The only real solution to credential stuffing is a unique, random password for every account. Humans cannot do this manually, which is why password managers exist. Generate 16–20 character random strings and let the manager remember them.

5. Watch for Phishing Follow-Ups

After a major breach, attackers often send targeted phishing emails using the leaked data ("We noticed suspicious activity on your account…"). Be extra suspicious of urgent emails in the weeks after a breach.

How to Prevent Future Password Leaks From Hurting You

You can't stop companies from being breached — that's out of your control. What you can control is making sure a breach of Company X doesn't cascade into every other service you use.

Use a Password Manager

This is the single most impactful security upgrade most people can make. Free options like Bitwarden and Proton Pass are excellent. Paid options like 1Password offer family sharing and travel features.

Turn On 2FA Everywhere That Supports It

Prioritize email, banking, cloud storage, social media, and work accounts. The site 2fa.directory lists which services support which 2FA methods.

Use Email Aliases

Services like SimpleLogin, AnonAddy, Apple's Hide My Email, and Firefox Relay let you create a unique email alias for every site. If one leaks, you know exactly who leaked it — and you can disable just that alias without affecting anything else.

Shorten and Share Links Privately

When you share links publicly — in bios, newsletters, QR codes — use a privacy-focused shortener rather than one that aggressively tracks the people who click. Lunyb is a privacy-first URL shortener that doesn't build advertising profiles on your audience, which is useful if you're already making security-conscious choices elsewhere. (If you're evaluating shorteners, we covered the trade-offs in our honest Lunyb review and compared it to the dominant paid option in our Rebrandly review.)

Freeze Your Credit

If a breach exposed your name, address, date of birth, or Social Security number (or local equivalent), place a free credit freeze with the major credit bureaus. This prevents attackers from opening accounts in your name even if they have your data.

Use Encrypted DNS and a Privacy-Respecting Browser

Encrypted DNS (DoH/DoT via providers like Cloudflare 1.1.1.1, Quad9, or NextDNS) stops network operators from seeing your DNS queries. Pair it with a hardened browser like Firefox, Brave, or LibreWolf for better default protection against trackers that often correlate with phishing infrastructure.

Signs Your Credentials May Already Be Compromised

Sometimes you don't need a tool — the warning signs are already there:

Password reset emails you didn't request
Login notifications from unfamiliar locations or devices
Friends receiving spam "from you" on social media or email
Unknown charges on cards linked to online accounts
Being locked out of an account that worked yesterday
New apps or browser extensions you didn't install
Two-factor codes arriving unexpectedly

If any of these happen, assume compromise and start the cleanup process above immediately — don't wait for "confirmation."

How Often Should You Check for Leaked Passwords?

Set up automated monitoring once, and you won't have to think about it again. At minimum:

One-time: Register your email with Have I Been Pwned's notification service — they'll email you when a new breach includes your address.
Monthly: Run your password manager's security audit.
Quarterly: Review active sessions and connected apps on your key accounts (Google, Apple, Microsoft, Meta, GitHub).
Annually: Prune accounts you no longer use. The fewer sites holding your data, the smaller your blast radius.

Frequently Asked Questions

Is it safe to type my password into a breach checker?

Only if the tool uses k-anonymity or client-side hashing, like Have I Been Pwned's Pwned Passwords API. These tools never see your actual password — only a small fragment of its hash. Avoid any checker that asks for your full password in plain text without explaining its hashing method.

My password shows up in a breach, but I never used that site. How?

Two likely explanations: you used the password somewhere else that was breached, or the same password is simply common enough that many people used it (e.g., "Summer2024!"). Either way, retire the password everywhere you used it.

How long does it take for a breach to show up in Have I Been Pwned?

It varies. Some breaches appear within days of being made public; others take months, especially if the data circulates privately on criminal forums first. This is why continuous monitoring (via a password manager or HIBP notifications) beats one-time checks.

If I change my password, am I safe from that breach forever?

Yes, for that specific credential — attackers can no longer log in with the old password. But if the breach also exposed security questions, phone numbers, or recovery emails, you should update those too. And enable 2FA so a future breach doesn't matter as much.

Do I need to pay for "dark web monitoring" services?

Usually not. Free tools like Have I Been Pwned, Google Password Checkup, and your browser's built-in monitor cover the same breach databases that paid services use. Paid dark web monitoring is only worth it if it's bundled with identity theft insurance and remediation help — not for the alerts alone.

Final Thoughts

Checking whether your password was leaked takes two minutes, and setting up continuous monitoring takes five. Combine that with a password manager, 2FA on your most important accounts, and email aliases for new signups, and you'll be ahead of 95% of internet users — including most of the people who end up as victims of credential stuffing every year. Breaches will keep happening. Your job isn't to prevent them; it's to make sure they don't reach you.