How to Check if Your Password Was Leaked in a Data Breach (2026 Guide)

If you've ever reused a password or kept the same login for years, there's a strong chance it has been exposed in one of the thousands of data breaches reported since 2013. Billions of credentials now circulate on the dark web, paste sites, and underground forums — often bundled into massive "combo lists" used for automated account takeover attacks.

The good news: you can check if your password was leaked in a data breach in under two minutes using free, reputable tools. This guide walks you through exactly how to do it safely, what to do if you find a match, and how to prevent future exposure.

What Does It Mean When a Password Is "Leaked"?

A leaked password is any credential that has appeared in a publicly accessible data breach, paste dump, or stealer log. Once a password enters these datasets, attackers use automated tools called credential stuffing bots to try that same email/password combination across hundreds of popular websites.

Leaks typically come from four sources:

1. Company data breaches — hackers steal user databases from services like LinkedIn, Adobe, Dropbox, or smaller sites you may have forgotten about.
2. Infostealer malware — trojans running on infected devices silently harvest saved browser passwords and upload them to attacker servers.
3. Phishing campaigns — fake login pages capture credentials that are then resold in bulk.
4. Third-party vendor compromises — breaches at analytics, payment, or support providers that held your data indirectly.

Even if the breach happened five or ten years ago, the password is still dangerous if you're still using it — or a slight variation of it — anywhere today.

How to Check if Your Password Was Leaked in a Data Breach

There are two safe ways to check: by email address (to see which breaches affected you) and by password itself (to see if that specific string has been exposed). Both can be done without ever transmitting your full password to a third party.

Method 1: Check Your Email Address with Have I Been Pwned

Have I Been Pwned (HIBP) is the most trusted free breach-notification service in the world. It's run by security researcher Troy Hunt and indexes over 12 billion compromised accounts from more than 800 known breaches.

Here's how to use it:

1. Go to haveibeenpwned.com.
2. Enter your email address in the search bar and click pwned?
3. Review the list of breaches your email has appeared in. Each entry shows the breach date, the company, and what data types were exposed (passwords, phone numbers, addresses, etc.).
4. Scroll to the bottom and sign up for Notify me so you get an email automatically if your address appears in future breaches.

Repeat this check for every email address you've used over the past decade, including old college, work, and throwaway accounts.

Method 2: Check a Specific Password with the Pwned Passwords Tool

HIBP also runs a separate service called Pwned Passwords, which lets you check whether a specific password has appeared in any breach without ever sending the full password over the internet. It uses a technique called k-anonymity: your browser sends only the first 5 characters of the SHA-1 hash, and the server returns a list of matching hash suffixes to compare locally.

1. Visit haveibeenpwned.com/Passwords.
2. Type the password you want to check.
3. The page instantly shows how many times that exact password has appeared in known breaches. A result of "Oh no — pwned!" with any count above zero means attackers already have it on their lists.

A password that shows up even once should be considered burned — change it everywhere you use it.

Method 3: Use Your Browser's Built-In Password Checkup

Modern browsers now scan your saved passwords against known breach databases automatically. This is the fastest way to audit dozens of logins at once.

• Google Chrome: Go to chrome://settings/passwords/check and click Check now. Chrome flags weak, reused, and compromised passwords.
• Microsoft Edge: Open Settings → Profiles → Passwords → Password Monitor.
• Apple Safari / iCloud Keychain: On iOS go to Settings → Passwords → Security Recommendations. On macOS open System Settings → Passwords.
• Mozilla Firefox: Firefox Monitor is built in — visit about:logins and look for alerts beside each saved login.

Method 4: Use Your Password Manager's Breach Report

If you use a dedicated password manager, it almost certainly includes a security audit feature that cross-references your vault against breach data.

• 1Password — Watchtower
• Bitwarden — Data Breach Report and Exposed Passwords Report (free tier)
• Dashlane — Dark Web Monitoring
• NordPass — Data Breach Scanner
• Proton Pass — Pass Monitor

These tools are especially useful because they check all your saved passwords at once and continue monitoring in the background.

Are Password-Checking Websites Safe to Use?

Legitimate breach-check tools are safe when they use k-anonymity or hashed lookups, meaning your full password never leaves your device. Have I Been Pwned, 1Password, Bitwarden, and the major browsers all use this approach.

Red flags for untrustworthy sites include:

• Requiring you to type your password into a plain form with no explanation of hashing.
• Asking for your email and password together to "check your account."
• No HTTPS, no privacy policy, or a suspicious domain name mimicking a well-known brand.
• Pushing you to install browser extensions or desktop apps to run the check.

When in doubt, stick to haveibeenpwned.com or your browser's built-in tool. Never paste your current password into a random site you found through an ad.

Comparison of Popular Breach-Check Tools

Tool	Checks Email	Checks Password	Ongoing Monitoring	Cost
Have I Been Pwned	Yes	Yes (k-anonymity)	Email alerts	Free
Google Password Checkup	Linked to account	Yes (all saved)	Automatic	Free
Firefox Monitor	Yes	Yes (saved logins)	Email alerts	Free
Bitwarden Reports	Yes	Yes (vault scan)	On-demand	Free tier
1Password Watchtower	Yes	Yes (vault scan)	Real-time	Paid
Dashlane Dark Web Monitoring	Yes (5 emails)	Yes	Real-time	Paid

What to Do if Your Password Was Leaked

Finding your credentials in a breach is stressful, but the response plan is simple. Act in this order:

1. Change the compromised password immediately on the breached site, and anywhere else you reused it. Use a unique, random password of at least 16 characters.
2. Enable two-factor authentication (2FA) on the affected account. Prefer an authenticator app (Aegis, 2FAS, Authy, Google Authenticator) or a hardware key (YubiKey) over SMS.
3. Audit linked accounts. If the breached account was your main email, assume attackers may have used password resets to pivot into other services. Review recent login activity on Gmail, Outlook, banking, and social accounts.
4. Revoke active sessions and app tokens in the account's security settings. This kicks out any attacker who may already be logged in.
5. Check for financial fraud. If payment data was part of the breach, monitor your card statements and consider a credit freeze with the major bureaus.
6. Watch for phishing. Breached email addresses get flooded with targeted phishing. Be extra skeptical of "security alert" emails asking you to click links.

Pros and Cons of Acting Fast vs. Waiting

Approach	Pros	Cons
Change passwords immediately	Stops credential stuffing instantly; peace of mind	Time investment of 1–2 hours for major audits
Wait for the company to notify you	No effort required upfront	Notifications can take months or never arrive; account may already be drained

How to Prevent Future Password Leaks

You can't stop companies from being breached, but you can make sure a single breach never cascades into a disaster.

1. Use a Password Manager and Never Reuse Passwords

Credential stuffing only works because people reuse passwords across sites. A password manager generates a unique 20+ character password for every account, so one breach stays contained. Bitwarden and Proton Pass both offer solid free tiers.

2. Turn On Two-Factor Authentication Everywhere

Even if your password leaks, 2FA blocks over 99% of automated attacks. Prioritize 2FA on your email, banking, cloud storage, and social accounts first.

3. Use Email Aliases to Compartmentalize Risk

Services like SimpleLogin, Addy.io, Apple Hide My Email, and Firefox Relay let you create a unique email alias for every website. If one alias starts receiving spam or appears in a breach, you know exactly which service leaked it — and you can disable the alias instantly.

4. Shorten and Share Links Safely

If you share links with your audience, team, or clients, use a privacy-respecting link shortener that doesn't bundle your traffic into advertising datasets. Lunyb is a privacy-first URL shortener with HTTPS, malware scanning, and minimal data collection — a smaller attack surface than ad-funded shorteners. You can read more in our honest Lunyb review.

5. Keep Your Devices and Browsers Updated

Infostealer malware is now one of the top sources of fresh credential leaks. Keeping your operating system, browser, and extensions patched closes the most common delivery paths. Avoid pirated software and sketchy browser extensions — they're the #1 vector for stealer infections in 2026.

6. Enable Breach Monitoring Alerts

Set up ongoing monitoring with Have I Been Pwned's notification service or your password manager's dark-web alerts. Early notice can be the difference between changing one password and recovering a hijacked account.

Common Mistakes to Avoid

• Adding a number or symbol to an old password. Attackers run mutation rules — Password123! is cracked just as easily as Password123.
• Checking passwords on random "is my password safe?" websites. Many are credential-harvesting honeypots.
• Ignoring old accounts. That 2012 forum signup with your main email and recycled password is still a live liability.
• Using SMS 2FA for high-value accounts. SIM-swap attacks make SMS the weakest 2FA option. Use apps or hardware keys for anything financial.
• Storing passwords in a plain text file or spreadsheet. One infostealer infection and everything is gone.

Frequently Asked Questions

How often should I check if my password was leaked?

Do a full audit at least every three months, and run a quick Have I Been Pwned check anytime you hear about a major breach in the news. If you've enabled notification alerts, you'll be told automatically when your email appears in new datasets.

Is it safe to type my real password into Have I Been Pwned?

Yes. HIBP uses k-anonymity, which means your browser only sends the first 5 characters of the SHA-1 hash of your password, never the password itself. The server can't reconstruct what you typed. That said, if you're uncomfortable, use your browser's built-in checkup instead, which does everything locally.

My password shows up with a count of 1 — is it really dangerous?

Yes. Any appearance in a breach corpus means that exact string is already on attacker wordlists used for credential stuffing and brute-force attacks. Change it on every account where you've used it, and switch to a unique generated password going forward.

What if my email appears in a breach but I don't remember the account?

This is extremely common with breaches from 10+ years ago. Try to log into the service and either update the password or delete the account entirely. If you can't recall the service at all, at minimum change the password on your email account (since that was the exposed credential's partner) and enable 2FA there.

Can I prevent my passwords from ever being leaked again?

You can't control third-party breaches, but you can make them harmless. The combination of unique passwords (via a password manager), 2FA on every important account, email aliases, and ongoing breach monitoring means that even when a service you use gets hacked, the damage stops at that one account.

Final Thoughts

Checking if your password was leaked in a data breach takes less than two minutes, and doing it regularly is one of the highest-impact security habits you can build. Pair it with a password manager, 2FA, and privacy-respecting services, and you'll be ahead of 95% of internet users — including the ones attackers target first.

Start now: open haveibeenpwned.com, check your primary email, and work through the response steps above for anything that shows up. Your future self will thank you.