How to Check if Your Password Has Been Leaked in the US

Every week, another company reports a data breach, and every breach spills usernames, email addresses, and passwords onto the internet. If you reuse the same password, a leak at a store you barely remember can hand a stranger the keys to your email, your bank, and your social media. Checking takes about five minutes with free tools. Here is how to check safely, what to do if you find a match, and how to stop it happening again.

What a leaked password actually means

When a website is breached, attackers copy its user database. That database usually holds email addresses and passwords, often scrambled, but weak or common passwords can be unscrambled quickly. The stolen data then circulates in breach collections that other criminals buy, trade, and feed into automated login attempts. This is called credential stuffing: bots try your leaked email and password on hundreds of sites, hoping you reused it somewhere important.

A leak does not mean someone has already broken into your accounts. It means the password is out there and can be tried, and the risk is highest when the same password protects several accounts. Treat any password that appears in a breach as burned, even if nothing bad has happened yet.

Step 1: Check your email with Have I Been Pwned

Have I Been Pwned is a free service run by security researcher Troy Hunt. It holds billions of records from known breaches, and it lets you search them without handing over your password.

Open haveibeenpwned.com and type in the email address you use most. The site lists any known breaches involving that address, by name and date, with a note on what was exposed. Run the same check for every email address you use, including old ones and addresses used for shopping or social accounts.

A clean result only means the address has not shown up in the breaches this service knows about. If it shows breaches, note which services were involved and what was exposed, since that list tells you which passwords to change first.

Step 2: Check your passwords without typing them in

You should never paste a live password into a random website that promises to check it. There are two safe ways to check passwords themselves.

The first is built into your browser or password manager. In Chrome, open Settings, then Autofill and passwords, then Google Password Manager, and run Password Checkup. It flags saved passwords that have appeared in a leak, along with weak and reused ones. On iPhone, the same check lives in Settings, then Passwords, then Security Recommendations. Your actual passwords are not sent to a server in readable form.

The second option is the Pwned Passwords search on haveibeenpwned.com. It uses a method called k-anonymity: your browser sends only the first five characters of a scrambled version of your password, and the rest is checked on your own device. Your full password never leaves your computer. Any result above zero means it is time to change it.

Step 3: Work through the breach list

If your email appears in one or more breaches, act the same day. Start with the accounts that matter most: your email, your bank and payment apps, and any account holding personal documents or photos. Change the password on each one.

While you are there, check recent sign-ins, connected devices, and active sessions under the security or privacy page. Sign out of sessions you do not recognize and confirm your recovery email and phone number are still yours, since attackers who reach an inbox often change those first.

Then work down the list to shopping, streaming, and social accounts. A leaked password on a store account is less dangerous than one on your email, but change it anyway, or close the account if you no longer use it.

Step 4: Replace reused passwords with unique ones

The check only helps if the passwords you switch to are different from each other. A unique password for every account means one leak can never spread. The easiest way to manage that is a password manager, such as the one built into your browser or a standalone app like Bitwarden or 1Password. Let it generate a long random password for each site and remember them for you.

If you prefer to memorize passwords, use passphrases: four or five random words strung together. They resist guessing and are easy to remember. Never build a password from your name, birthday, pet, or favorite team, since those are the first things an attacker tries.

While you are at it, turn on two-factor authentication on your email, bank, and social accounts. With it switched on, a leaked password alone is not enough to get in, because the attacker also needs a code from your phone or an authenticator app. An app code is stronger than a text message, but either one is far better than nothing.

Step 5: Make this a habit, not a one-time chore

Breaches happen constantly, so a clean result today says nothing about next month. Run the email check every few months, and again whenever you hear about a big breach. Most password managers can watch for leaks automatically and warn you when a saved password shows up in a new breach.

Watch for warning signs too: password reset emails you did not request, a login alert from a place you have never been, or a friend saying your account sent them a strange link. The faster you act after a leak, the less damage it can do.

Frequently Asked Questions

Is Have I Been Pwned safe to use?

Yes. The site is run by a well-known security researcher and is widely used by security teams. Checking an email address only tells the site which address to look up, and the Pwned Passwords search never sends your full password anywhere. Never type a password into any other site that claims to check leaks.

My email was in a breach but my password was not listed as exposed. Do I still need to change it?

If the breach exposed passwords and you used the same one anywhere else, change it everywhere. Breach reports sometimes understate what was taken. When in doubt, change it and move on.

What should I do if I used the same password on many sites?

Change it on your most important accounts first: email, banking, and anything tied to payments. Then work through the rest, giving each account its own new password. A password manager makes this far quicker.