How to Check if Your Password Has Been Leaked in Australia

Your password can be stolen without you ever knowing. Data breaches at companies you use every day spill millions of passwords onto the internet, and criminals try those passwords on other sites within hours. The good news is that checking whether your password has been leaked takes about two minutes, and the tools that do it are free. This guide shows you how to check in Australia, what to do if you find a match, and how to stop it happening again.

Step 1: Check your email address on Have I Been Pwned

Start with Have I Been Pwned, a free service run by Australian security researcher Troy Hunt. Go to haveibeenpwned.com and type in your email address. The site will tell you which known data breaches included that address, and what kind of data was exposed in each one.

If your address appears in a breach, do not panic. Being in a breach list means your email address was exposed, not that someone has your current password. What matters is whether passwords were included, and whether you still use the same password anywhere. Note down the breaches that mention passwords, because those are the accounts you need to fix first. You can also sign up for free breach notifications on the same site, so you get an email the next time your address turns up in a new breach.

Step 2: Check the password itself with Pwned Passwords

Have I Been Pwned also runs a service called Pwned Passwords, which checks a single password against a database of more than a billion leaked passwords. The clever part is how it protects your privacy. Your password never leaves your device in full. Instead, your browser sends only the first few characters of a scrambled version of it, and the matching happens on your side.

To use it, go to the Pwned Passwords page and type in a password you use. If it has appeared in a breach, the site will tell you how many times. A password that has shown up thousands of times is effectively public knowledge, and you should stop using it everywhere, right away. A password with zero matches is not proof that it is strong, only that it has not been seen in a known breach yet. Check your most reused passwords first, starting with your email account, since email is the key to resetting almost everything else.

Step 3: Run your phone's built-in password check

Your phone can check every password you have saved, all at once. On iPhone, open Settings, then Passwords, then Security Recommendations. Your phone will list any saved passwords that have appeared in a data breach, any that you reuse across sites, and any that are weak. Tap each one to see which account it belongs to and change it from there.

On Android, open Chrome, tap the three dots, then Settings, then Password Manager, then Check passwords. Google will check your saved passwords against known breaches and flag the ones that need changing. If you use a Samsung phone, the same check is available in Samsung Pass or in Chrome, depending on where your passwords are saved. Run this check every few months, and always run it after you hear about a big breach in the news.

Step 4: Change the leaked passwords, starting with email

If a password has been leaked, change it on that account first, then on any other account where you used the same password. Start with your email, then your bank, then social media and shopping accounts. Use a different password for every important account from now on. Reusing one password across sites is the single habit that turns one breach into many.

Make the new passwords long rather than complicated. A passphrase of four random words is both easier to remember and harder to crack than a short jumble of symbols. A password manager can generate and remember unique passwords for you, and both iPhone and Android have one built in. Turn on two-factor authentication for your email, bank and social media accounts as well. It adds a second check, usually a code from an app on your phone, so a leaked password alone is not enough to get in.

Step 5: Know where to report it in Australia

If your details were exposed in a breach involving an Australian company, that company is required to tell you if the breach is likely to cause you serious harm. That rule comes from the Notifiable Data Breaches scheme under the Privacy Act, which is overseen by the Office of the Australian Information Commissioner. If a company tells you about a breach, follow its advice, but change your password and check your accounts yourself too.

If you think someone has used your leaked details to commit fraud, contact IDCARE on 1800 595 160. It is Australia's free national identity and cyber support service, and it can walk you through what to do next. You can also report scams and identity theft to Scamwatch at scamwatch.gov.au. If money has been taken from your bank account, call your bank straight away and ask for its fraud team.

Frequently Asked Questions

Is Have I Been Pwned safe to use?

Yes. Have I Been Pwned is run by Australian security researcher Troy Hunt and is widely trusted by security professionals. When you check an email address, the site only tells you whether that address appears in known breaches. When you check a password with Pwned Passwords, the password never leaves your device in full. Never type your password into a random breach checking site you have not verified.

What should I do first if my password has been leaked?

Change the password on that account immediately, then change it on any other account where you used the same one. Start with your email account, because it is used to reset almost everything else. Then turn on two-factor authentication for your email, bank and social media accounts, and stop reusing passwords by using a password manager.

Does changing my password fix a data breach?

Changing your password stops anyone from using the leaked one to get into that account, but it does not undo the breach itself. Your email address and other details may still be circulating, which is why you should watch for scam messages and unexpected account activity afterwards. If you suspect identity theft, call IDCARE on 1800 595 160 for free help.