Quick answer: The fastest way to check if your password was in a data breach is to use Have I Been Pwned, a free site, or the checker built into your phone or browser. Check your email address too, but an email match doesn’t mean the password you use now was leaked. If you find a match, change that password everywhere you used it.
What does “my password was in a data breach” really mean?
A data breach happens when a company’s records get exposed. Those records can include email addresses, usernames, and sometimes passwords. Once they leak, they can be shared and reused by criminals. There are two different questions here. One is “Was my email address in a breach?” The other is “Has this password appeared in a breach?” They aren’t the same.
Have I Been Pwned (HIBP) keeps them apart on purpose. Its FAQ says that when breached email addresses are loaded, no matching passwords are loaded with them. A separate service, called Pwned Passwords, checks whether one specific password has been seen in a breach. In plain terms, no free tool will tell you “this email with this password leaked.” It can tell you that your email was in a breach, or that a password has been exposed before.
Why does it matter? Reuse. If you use one password on many sites, a leak on one site can unlock the others. The FTC describes a case where a hacker got into a company’s database by reusing an executive’s seven-character password that had been made public in an unrelated breach.
How do you check if your password was in a data breach?
You have three free options. You don’t need all of them.
1. Have I Been Pwned (email and password). To check your email, go to haveibeenpwned.com, type your email address, and press the “pwned?” button. You’ll see which breaches included it. To check a password, go to haveibeenpwned.com/Passwords and type the password. HIBP says a password found there has appeared in a breach and shouldn’t be used anymore. A clean result is good news, but it only covers breaches that HIBP knows about.
2. Your iPhone. Go to Settings, then Passwords, then Security Recommendations. It lists accounts whose saved passwords appeared in a known data leak, plus passwords that are reused or weak. On newer versions of iOS, the Passwords app has a Security section that does the same job. If you want to stop the alerts, there’s a switch called Detect Compromised Passwords in the same menu.
3. Google Password Checkup (Android and Chrome). Google says Password Checkup shows whether passwords in your Google Account may have been exposed, are weak, or are used on multiple accounts. On Android, open Settings, search for “Password Manager,” tap it, then tap Password Checkup. In Chrome, select your profile picture, choose Passwords, then pick Checkup on the left. You can also go to passwords.google.com and choose Password Checkup.
Google adds a smart tip: if you get a message saying your password is unsafe, go straight to Password Checkup yourself. That way you know the alert is real. Many password managers also flag exposed passwords. Look for a security check inside yours.
Is it safe to type your password into a checker?
On the real HIBP site, yes, because your password isn’t sent as you typed it. HIBP says the password is anonymized before it’s sent. Its creator, Troy Hunt, explains the method: only the first five characters of a scrambled version (a hash) of your password are sent. Many different passwords share those same five characters, so the site can’t tell which one you checked.
Still, follow two rules:
- Only use haveibeenpwned.com. Never type your password into other sites that offer to “check” it.
- Don’t want to type a real password at all? Use the checker built into your phone or browser instead.
What if your email shows up in a breach?
Don’t panic. A match means your email was in a company’s records, not that someone is inside your account.
Click the breach name and look at three things: the date, the company, and the type of data that leaked. If passwords weren’t included, you don’t have to change a password. Just watch for odd emails.
If passwords were included and you still use that site, change your password. If you used the same password somewhere else, change it there too. Start with your email account, then your bank. The company may have already forced a reset, but it’s quick to check for yourself.
What should you do for each type of data that leaked?
The FTC says to visit IdentityTheft.gov/databreach for advice based on what was exposed. Here’s the short version:
| What leaked | What to do |
| A login or password | Log in and change the password. Change it anywhere else you used it. Change your security questions too. |
| Payment card details | Call your bank or card company and ask for a new card number. Look over your statements for charges you don’t recognize. |
| Social Security number | Get your free credit reports at annualcreditreport.com and look for accounts you don’t recognize. Consider a credit freeze or fraud alert. Accept free credit monitoring if the company offers it. |
| Something else, or you’re not sure | Go to IdentityTheft.gov/databreach and answer the questions to get steps for your situation. |
Also, watch out for scam messages after a breach. The FTC warns that scammers use breaches as a hook to trick you into giving up personal information. Never tap a link in a “your password leaked” email. Go to the site yourself.
How do you stay ahead of the next breach?
Two habits do most of the work.
First, use a different password for every account. A long passphrase for your main accounts, and a password manager for the rest, makes reuse a non-issue.
Second, turn on alerts. HIBP has a “Notify me” feature that emails you when your address shows up in a future breach. Your phone’s Security Recommendations and Google’s Password Checkup also check in the background.
Step-by-step: what to do
- Go to haveibeenpwned.com and enter your email address.
- Read each breach it lists: the company, the date, and the data that leaked.
- Check your main password at haveibeenpwned.com/Passwords.
- Open Security Recommendations on your iPhone, or Password Checkup on Android or Chrome.
- Change every password that shows up as exposed.
- Change any other account that shares one of those passwords.
- Start with your email, then your bank and shopping accounts.
- If a card or Social Security number leaked, follow the FTC steps for that data.
- Turn on two-factor authentication for your key accounts.
- Sign up for HIBP’s “Notify me” alerts.
Common mistakes to avoid
- Typing your password into any site that offers to “check” it.
- Tapping a link in an email that says your password leaked.
- Changing the password on one site but leaving the same one on others.
- Choosing a new password that’s just the old one with a small change.
- Ignoring a breach notice because the account is old.
- Assuming a clean result means you’re safe forever.
Frequently asked questions
Does a data breach mean my account was hacked? Not by itself. It means your information was exposed. The risk goes up if you reused the leaked password somewhere else, which is why changing it everywhere matters.
Has my password been leaked if the checker finds nothing? It probably hasn’t appeared in a breach that HIBP knows about, which is good news. But new breaches happen, so a clean result today isn’t a guarantee. Alerts help you catch the next one.
How often should I check? You don’t have to remember. Turn on HIBP’s “Notify me” alerts and keep your phone’s or browser’s password checker switched on, and they’ll flag problems for you.
Final thoughts
Check once today, change whatever shows up, and turn on alerts so you don’t have to remember to check again.