How to Check if Your Password Was Leaked in a Data Breach (2026 Guide)

Every year, billions of login credentials are exposed in data breaches — from major corporate hacks to small website leaks that quietly end up on dark web forums. If you've reused a password across multiple accounts (and most people have), a single breach can compromise your email, banking, social media, and work logins at once. The good news: there are fast, free, and secure ways to check if your password was leaked in a data breach, and simple steps to lock down your accounts afterward.

This guide walks you through exactly how to check whether your credentials have been exposed, which tools to trust, what to do if you find a match, and how to prevent future leaks from hurting you.

What Does It Mean When a Password Is "Leaked"?

A leaked password is a credential that has been exposed publicly — usually through a hacked database — and is now circulating on paste sites, hacking forums, or dark web marketplaces. Attackers collect these leaks into massive combo lists and use them in automated attacks called credential stuffing, where they try your email and password combination on hundreds of popular services.

Leaks happen in a few common ways:

• Database breaches: A company's servers are hacked and user records are stolen.
• Misconfigured cloud storage: Unprotected databases are indexed by search engines like Shodan.
• Phishing campaigns: Credentials entered on fake login pages are collected and resold.
• Infostealer malware: Browser-saved passwords are silently exfiltrated from infected devices.

Once leaked, a password is essentially public forever. The question isn't whether you should check — it's how often.

How to Check if Your Password Was Leaked in a Data Breach

The fastest way to check if your password was leaked in a data breach is to use a reputable breach-notification service that compares your email or password against a database of known exposed credentials. These services use cryptographic hashing so your actual password is never transmitted or stored.

Here is the recommended process:

1. Go to a trusted breach-check service (listed below).
2. Enter your email address or use the dedicated password-check tool.
3. Review the list of breaches that include your data.
4. Identify which specific passwords and accounts are affected.
5. Change those passwords immediately on every site where you reused them.
6. Enable two-factor authentication (2FA) on all critical accounts.

Top Free Tools to Check for Leaked Passwords

Several well-respected services let you check your credentials safely and for free. The table below compares the most popular options.

Service	Checks	Privacy Method	Price	Best For
Have I Been Pwned	Email + password	k-Anonymity (SHA-1 hash prefix)	Free	Most comprehensive breach database
Google Password Checkup	Saved Chrome passwords	Encrypted hash comparison	Free with Google account	Chrome and Android users
Mozilla Monitor	Email	Uses HIBP data	Free / Plus $8.99/mo	Firefox users and ongoing monitoring
Apple Password Monitoring	iCloud Keychain passwords	Private Set Intersection	Free on iOS 14+	Apple ecosystem users
1Password Watchtower	All saved vault passwords	Hashed query to HIBP	From $2.99/mo	Password manager users

Using Have I Been Pwned (Step-by-Step)

Have I Been Pwned (HIBP), run by security researcher Troy Hunt, is the gold standard for breach lookups. It indexes more than 13 billion compromised accounts across hundreds of breaches.

Check Your Email Address

1. Visit haveibeenpwned.com.
2. Type your email address into the search box and press "pwned?".
3. If your email appears in any breaches, you'll see a red screen listing each one, the date, and what data was exposed (passwords, phone numbers, physical addresses, etc.).
4. Scroll through each breach to understand which accounts you need to secure first.

Check a Specific Password

HIBP also has a Pwned Passwords section where you can test a specific password without it ever leaving your browser in plain text.

1. Go to haveibeenpwned.com/Passwords.
2. Type the password you want to check.
3. The tool hashes your password locally using SHA-1, sends only the first five characters of the hash to the server, and the server returns all matching hashes for comparison on your device.
4. If a match is found, you'll see how many times that password has appeared in breaches. Even one match means you should stop using it.

Set Up Breach Alerts

HIBP lets you subscribe for free notifications. Enter your email, confirm it, and you'll be alerted automatically the next time your address appears in a new breach — often months before the breached company notifies you directly.

Using Your Browser's Built-In Password Checker

Modern browsers now include password-breach monitoring that works automatically in the background. Here's how to enable and use it in each major browser.

Google Chrome / Chromium Browsers

1. Open Chrome and go to Settings > Autofill > Password Manager.
2. Click "Checkup".
3. Chrome will scan your saved passwords and flag any that are compromised, reused, or weak.
4. Click "Change password" next to each flagged entry to go directly to the affected site.

Mozilla Firefox

1. Open about:logins in the address bar.
2. Firefox automatically marks compromised credentials with a yellow warning icon.
3. Click the warning to see details and update the password on the source site.

Microsoft Edge

1. Open Settings > Profiles > Passwords.
2. Scroll to "Password Monitor" and turn it on.
3. Edge will scan all saved passwords and send alerts when a leak is detected.

Safari (macOS / iOS)

1. Open System Settings > Passwords (macOS) or Settings > Passwords (iOS).
2. Look for the "Security Recommendations" section.
3. Review entries flagged as compromised, reused, or easily guessed.

What to Do if Your Password Was Leaked

Finding a match is unsettling, but acting quickly limits the damage. Follow these steps in order:

1. Change the leaked password immediately on the affected site. Use a unique password you've never used before.
2. Change it on every other site where you reused it. This is the single most important step — credential stuffing attacks succeed because of reuse.
3. Enable two-factor authentication. Prefer an authenticator app (Authy, Aegis, Google Authenticator) or a hardware key (YubiKey) over SMS.
4. Review recent account activity. Check login history, connected devices, and sent emails for anything unfamiliar.
5. Revoke suspicious sessions and app permissions. Most major services let you sign out all other devices with one click.
6. Scan your device for malware. If an infostealer caused the leak, changing passwords alone won't help — you need to remove the malware first.
7. Monitor your financial accounts for unauthorized transactions over the next 30–60 days.
8. Consider freezing your credit if the breach exposed personal data like Social Security numbers or dates of birth.

How to Prevent Future Password Leaks

You can't stop companies from being breached, but you can make leaks nearly harmless to you personally. The core principle: assume every password you use will eventually leak, so limit the blast radius.

Use a Password Manager

A password manager generates and stores a long, random, unique password for every account. If one site is breached, that password is useless anywhere else. Popular options include Bitwarden (free and open source), 1Password, Dashlane, and Proton Pass.

Pros of password managers:

• Unique passwords for every account by default
• Built-in breach monitoring
• Autofill prevents phishing on lookalike domains
• Encrypted sync across all your devices

Cons to be aware of:

• Your master password becomes a single point of failure — make it long and unique
• Cloud-based managers themselves can be targeted (LastPass 2022)
• Learning curve for non-technical users

Turn On Two-Factor Authentication Everywhere

2FA means a stolen password alone isn't enough to break into your account. Prioritize these account types:

1. Primary email (this is your "skeleton key" — if it falls, everything else follows via password resets)
2. Banking and payment apps
3. Cloud storage (Google Drive, iCloud, Dropbox)
4. Social media and work accounts
5. Domain registrars and hosting providers

Use Email Aliases

Services like Apple Hide My Email, SimpleLogin, and Firefox Relay let you create a unique email alias for each site you sign up to. If one is leaked, you can disable just that alias instead of changing your real email address everywhere.

Be Careful What You Click

Many breaches start with a single phishing click. Hover over links before clicking, especially in emails. When you're sharing links yourself — whether in marketing, support messages, or on social — use a reputable URL shortener that scans destinations and offers analytics so you can see when something behaves abnormally. Lunyb is one option that focuses on both privacy and link safety; we cover more about it in our honest Lunyb review and compare it to alternatives in our 2026 URL shortener buyer's guide.

Harden Your Network Layer

Beyond passwords, protecting the DNS and transport layer makes it harder for attackers to intercept credentials in the first place. Turn on encrypted DNS (DNS over HTTPS or DNS over TLS) in your browser or router, and use HTTPS-Only mode so your browser refuses to send passwords over unencrypted connections.

Red Flags: Signs Your Account May Already Be Compromised

Sometimes a breach notice arrives late — or never. Watch for these warning signs that an account has been accessed by someone else:

• Password reset emails you didn't request
• Login notifications from unfamiliar locations or devices
• Sent emails you don't remember writing
• Friends receiving spam or scam messages "from you"
• New apps, forwarders, or filters you didn't set up in your email
• Missing emails (attackers often auto-delete security alerts)
• Small unexplained charges on your card (fraud testing)
• Being logged out of accounts unexpectedly

If any of these appear, treat the account as compromised: change the password, revoke sessions, enable 2FA, and audit connected apps.

How Often Should You Check for Leaked Passwords?

At minimum, run a full breach check every three months. If you use a password manager with built-in monitoring, it will do this continuously for you. Also run an immediate check whenever:

• A major breach appears in the news
• You receive a notification from Have I Been Pwned or your browser
• You notice any of the red flags above
• You're about to use an old account you haven't touched in years

Frequently Asked Questions

Is it safe to type my password into a breach-check website?

It is safe only on reputable services that use cryptographic hashing — such as Have I Been Pwned's Pwned Passwords tool, which uses k-Anonymity so your full password never leaves your device. Avoid any site that asks for your password in plain text or wants your email and password together. When in doubt, check your email address instead of the password itself.

If my password is in a breach, does that mean someone has already accessed my account?

Not necessarily, but you should assume they will try. Leaked credential lists are tested automatically against hundreds of popular sites within hours of release. If your email and password combination works anywhere, that account will almost certainly be accessed. Change the password everywhere you've used it and enable 2FA immediately.

What's the difference between a data breach and a password leak?

A data breach is the broader event — a company's systems are compromised and data is stolen. A password leak specifically refers to credentials from that breach being published or sold. Not every breach results in a password leak (sometimes only emails or metadata are exposed), but any breach involving login data should be treated as a password leak.

Can hackers still use my password if the site hashed it?

Yes, depending on the hashing method. Weak or outdated hashes (MD5, SHA-1, unsalted SHA-256) can be cracked at billions of guesses per second using modern GPUs, so common passwords fall almost instantly. Strong hashes like bcrypt, scrypt, or Argon2 are far more resistant. You can't control which hash a company used, so always treat a breach as if the password is now public.

Do I need to pay for a breach monitoring service?

Most people don't. Free tools like Have I Been Pwned, Google Password Checkup, and Mozilla Monitor cover the essentials. Paid services add perks like dark-web scanning for Social Security numbers, identity theft insurance, and family plans. These are worth considering if you've already been a victim of identity theft or hold high-value accounts, but a password manager plus free monitoring is enough for the vast majority of users.

Final Thoughts

Checking if your password was leaked in a data breach takes about two minutes and can save you weeks of recovery work. Make it a quarterly habit, pair it with a password manager and 2FA, and the next inevitable breach becomes a minor inconvenience instead of a disaster. Your future self — and your bank account — will thank you.