How to Check if Your Password Was Leaked in a Data Breach (2026 Guide)

Every year, billions of credentials leak onto the internet through corporate data breaches, phishing kits, and credential-stuffing databases. If you've reused a password even once in the last decade, there's a strong chance it's already sitting in a hacker's wordlist. The good news: you don't have to guess. You can check if your password was leaked in a data breach in under two minutes using free, reputable tools — and then take clear steps to lock everything down.

This guide walks you through exactly how to do it, which services to trust, how the checking process works safely, and what to do the moment you find a match.

What Does It Mean if Your Password Was Leaked?

A leaked password is one that has appeared in a publicly known data breach or credential dump — a collection of usernames, emails, and passwords stolen from a company or website and later released, sold, or traded online. Once a password is leaked, it's added to attacker wordlists and used in credential stuffing attacks, where bots try that same email/password combination against thousands of other sites.

Even if the breach happened at a service you no longer use, the danger is real if you reused that password anywhere else. Attackers don't need to hack your bank — they just need to try your leaked Netflix password on it.

Common Sources of Leaked Passwords

• Corporate data breaches — LinkedIn, Adobe, Dropbox, MyFitnessPal, and hundreds of others.
• Combolists — massive compiled files like "Collection #1" (773 million records) or the RockYou2024 leak.
• Phishing kits — credentials harvested from fake login pages.
• Infostealer malware — trojans that scrape saved browser passwords from infected devices.
• Third-party service breaches — vendors that store login data on behalf of larger companies.

How to Check if Your Password Was Leaked in a Data Breach

There are two safe, well-established ways to check: search by email address (to find which breaches affected you) or search by password itself (to see if the exact string has been exposed). Both use privacy-preserving methods so you never send your real password over the internet in plain text.

Method 1: Check by Email Address with Have I Been Pwned

Have I Been Pwned (HIBP) is the industry-standard free service run by security researcher Troy Hunt. It indexes over 12 billion leaked accounts across hundreds of confirmed breaches.

1. Go to haveibeenpwned.com.
2. Enter your email address in the search box.
3. Click pwned?.
4. Review the list of breaches your email appears in, along with the date and what data was exposed (email, password, phone, address, etc.).
5. Repeat for every email address you've ever used — work, personal, old accounts, aliases.

If your email appears in a breach that included passwords, assume that password (and any variant of it) is compromised.

Method 2: Check the Password Itself (Safely)

HIBP also offers a Pwned Passwords service that lets you check if a specific password has ever appeared in a breach — without ever sending the full password over the network. It uses a technique called k-anonymity.

1. Visit haveibeenpwned.com/Passwords.
2. Type or paste the password you want to check.
3. Your browser hashes the password locally using SHA-1.
4. Only the first 5 characters of the hash are sent to the server.
5. The server returns all matching hashes in that range, and your browser checks locally for the exact match.
6. You'll see a count of how many times that password has appeared in leaks.

Any password with a count above zero should be considered burned. Passwords appearing tens of thousands of times (like "password123" or "qwerty") are cracked in milliseconds.

Method 3: Use Your Browser's Built-In Breach Checker

Modern browsers now check saved passwords against known breach databases automatically.

• Google Chrome / Google Password Manager: Go to passwords.google.com → Password Checkup.
• Apple Safari / iCloud Keychain: Settings → Passwords → Security Recommendations.
• Mozilla Firefox: about:logins → alerts appear automatically via Firefox Monitor.
• Microsoft Edge: Settings → Profiles → Passwords → Password Monitor.

Method 4: Use a Password Manager's Breach Report

Reputable password managers (1Password, Bitwarden, Dashlane, NordPass, Proton Pass) run continuous scans of your entire vault against breach databases and flag reused, weak, or compromised entries.

Comparison: Top Free Tools to Check Leaked Passwords

Tool	Checks Email	Checks Password	Database Size	Privacy Method	Cost
Have I Been Pwned	Yes	Yes	12B+ records	k-anonymity (hashed)	Free
Google Password Checkup	Via account	Yes (saved)	4B+ credentials	Encrypted hash lookup	Free
Firefox Monitor	Yes	No	Uses HIBP	Email-based alerts	Free
Apple Security Recommendations	No	Yes (saved)	Proprietary + HIBP	On-device comparison	Free
1Password Watchtower	Yes	Yes	HIBP + proprietary	Encrypted vault scan	Paid (with free trial)

Pros and Cons of Password Breach Checkers

Pros

• Free and fast — results in seconds.
• Privacy-preserving through hashing and k-anonymity.
• Continuous monitoring available with email alerts.
• Actionable — tells you exactly which accounts to fix first.
• Built into browsers and password managers you already use.

Cons

• Only covers known, public breaches — private dumps may not appear.
• Doesn't detect if your password will be leaked tomorrow.
• Fake "breach checker" sites exist that harvest passwords — always stick to trusted tools.
• Doesn't protect against phishing or keyloggers that steal fresh credentials.

What to Do if Your Password Was Leaked

Finding out you've been breached is only step one. Here's exactly what to do, in priority order:

1. Change the password immediately on the breached account and on every other account where you reused it.
2. Generate a unique, strong password for each site — minimum 16 characters, random, using a password manager.
3. Enable two-factor authentication (2FA) using an authenticator app (Authy, Google Authenticator, Aegis) or a hardware key like YubiKey. Avoid SMS 2FA where possible.
4. Check for suspicious activity — login history, connected devices, forwarding rules in email, and recent transactions.
5. Revoke old sessions and API tokens from your account security page.
6. Update security questions — treat their answers like passwords (random strings stored in your manager).
7. Freeze your credit with major bureaus if financial or identity data was exposed.
8. Set up breach monitoring so you're alerted the next time your email appears in a leak.

How to Prevent Future Password Leaks

You can't stop companies from getting breached, but you can make breaches harmless to you. The core principle: one leaked password should never expose more than one account.

1. Use a Password Manager

This is non-negotiable in 2026. A password manager generates and stores a unique random password for every site. Even if one leaks, the damage is contained. Recommended options include Bitwarden (free, open source), 1Password, Proton Pass, and KeePassXC.

2. Turn On Two-Factor Authentication Everywhere

2FA means that even a correct password isn't enough to log in. Prioritize enabling it on email, banking, cloud storage, and social accounts first — these are the recovery gateways for everything else.

3. Use Passkeys Where Available

Passkeys replace passwords with cryptographic keys tied to your device. They can't be phished, reused, or leaked in a breach because the server never stores a secret you know. Google, Apple, Microsoft, GitHub, and thousands of other sites now support them.

4. Practice Safe Link Handling

Many credentials are stolen not from breaches but from phishing links delivered by email, SMS, or social media. Before clicking any shortened or unfamiliar link, preview it. Services like Lunyb offer link management and preview features that help you see where a URL actually leads before you visit. For a broader comparison of trustworthy link tools, see our Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide.

5. Use Unique Email Aliases

Services like Apple Hide My Email, SimpleLogin, and Firefox Relay let you generate a unique email address for every signup. If one alias starts getting spam or appears in a breach, you know exactly which company leaked it — and you can burn that alias without changing your real email.

6. Enable Encrypted DNS and Private Browsing

Encrypted DNS (DNS over HTTPS or DNS over TLS) prevents attackers on your local network from redirecting you to fake login pages designed to steal credentials. Most modern browsers support it in settings.

Red Flags: Fake Password Checker Sites to Avoid

Attackers know people are worried about breaches, so they build convincing fake "leak checker" sites that actually harvest the passwords you type in. Warning signs include:

• Asking for your password without explaining how it's hashed.
• No HTTPS, or a misspelled domain (haveibeenpwneded.com, hibp-check.net, etc.).
• Requesting your full password and username together.
• Displaying alarming pop-ups urging you to "buy protection now."
• No transparency about the operator or data sources.

Stick to Have I Been Pwned, your browser's built-in checker, or your password manager's report.

How Often Should You Check?

Set up automatic monitoring once, then check manually every 3–6 months. Have I Been Pwned's free Notify me feature emails you whenever your address shows up in a new breach — this is the easiest way to stay ahead. Most password managers also send push notifications the moment a stored credential is flagged.

Frequently Asked Questions

Is it safe to type my password into Have I Been Pwned?

Yes. Pwned Passwords uses k-anonymity: your browser hashes the password locally with SHA-1 and only sends the first 5 characters of the hash to the server. The server can never see your actual password or even the full hash. That said, if you want extra caution, just check by email address instead.

What should I do if my password appears in a breach but I still use it?

Change it immediately on every site where you used it, enable two-factor authentication, and switch to a password manager so you never have to remember (or reuse) a password again. Assume attackers have already tried that password on every major service.

Can hackers use my leaked password even if the breach happened years ago?

Yes. Old breaches are constantly recompiled into new combolists. A password leaked in a 2013 breach is still actively used in credential-stuffing attacks today. Age doesn't make a leak safer — only changing the password does.

Do password managers really protect me from breaches?

They protect you from the consequences of breaches. A password manager can't stop a company from being hacked, but by ensuring every account has a unique random password, a single breach can never cascade into your other accounts. Combined with 2FA, this eliminates the vast majority of account takeover risk.

Are passkeys really better than passwords?

Yes, significantly. Passkeys are based on public-key cryptography, meaning the server only stores a public key that's useless to attackers. There's no shared secret to leak, no password to phish, and no code to intercept. Where a service offers passkeys, use them.

Final Thoughts

Checking if your password was leaked in a data breach takes two minutes and costs nothing — but it's one of the highest-impact security actions you can take. Run your email addresses through Have I Been Pwned today, review your browser's password checkup, and commit to two changes going forward: a password manager for unique credentials, and two-factor authentication (or passkeys) on every account that matters. Breaches will keep happening. What determines your safety is not whether your data leaks, but whether that leak can be used against you.