How to Check If Your Email or Password Was in a Data Breach

You get an email from a company you barely remember using: “We recently discovered unauthorized access to some customer data.” Or your phone pops up a warning that a saved password “appeared in a data leak.” Either way, the question is the same. Which of my accounts are exposed, and what do I fix first?

The good news is that checking takes about 5 minutes and costs nothing. This guide shows the free tools that check your email and passwords, how to read the results and the order to fix things in.

Why leaked passwords matter even from old breaches

When a company is breached, the stolen data often includes email addresses and passwords, sometimes scrambled (hashed) and sometimes not. Those lists get shared and sold, and criminals feed them into automated tools that try the same email and password on other sites. This is called credential stuffing, and it works because many people reuse passwords.

That’s why a breach at an old shopping site matters. If you used the same password for your email, the attacker doesn’t need to hack your email provider. They just log in.

Key takeaway: A leaked password is only dangerous where it’s still in use. Your goal isn’t to erase the breach, which you can’t do, but to make sure every leaked password is retired everywhere you used it.

Step 1: Check your email address in a breach database

The best-known free tool is Have I Been Pwned (haveibeenpwned.com), run by security researcher Troy Hunt. Enter your email address and it lists the known breaches that included it, with dates and the types of data exposed, such as passwords, phone numbers or addresses.

A few things to know:

• It’s free and, according to its FAQ, searches aren’t logged and are sent over an encrypted connection.
• Your email alone can’t open your accounts, so checking it doesn’t put you at risk.
• “No breaches found” doesn’t mean you’re safe. The database holds a large but incomplete set of breached records.
• You can sign up for alerts to get an email if your address shows up in a future breach.

Mozilla Monitor offers a similar free scan and breach alerts using Have I Been Pwned data, with a paid tier for removing data from broker sites.

Google previously offered a “dark web report,” but it stopped scanning for new breaches on January 15, 2026 and was retired on February 16, 2026. Google now points users to Password Checkup and Security Checkup instead.

Step 2: Check your saved passwords

Breach sites tell you where your email showed up. Password checkers tell you which of your actual passwords are known to criminals. Most people already have one built in.

On iPhone, make sure Detect Compromised Passwords is on, so your phone alerts you when a saved password shows up in a known leak. In Google Password Checkup, compromised passwords appear at the top of the list.

If you use a password manager, check its security dashboard. If you don’t, now is a good time to start; our guide on how password managers work explains the basics.

Step 3: Read the results without panicking

Results can look scary, especially if your email appears in 10 or more breaches. Here’s how to sort them:

• Passwords exposed in a breach: high priority if you still use that password anywhere.
• Email and name only: low risk on its own, but expect more phishing. Read up on how to spot phishing emails.
• Phone number: expect more scam texts and calls.
• Date of birth, address or Social Security number: an identity theft risk. Consider freezing your credit.
• Security questions or answers: change those answers anywhere they’re used.
• Breaches from sites you’ve deleted: still matter if you reused that password elsewhere.

A breach listing is a permanent historical record. Changing your password won’t make it disappear from the list, and it doesn’t need to.

Hashed vs plain-text passwords

Breach notices often say passwords were “hashed” or “encrypted.” That’s better than plain text, but it isn’t a guarantee. Short or common passwords can often be cracked from their hashes, especially if the company used an older, weaker method. Treat any password involved in a breach as exposed, whatever the notice says, and change it everywhere you used it.

Check for the rest of your household

Breaches don’t stop at you. A partner who shares a streaming login, a teen who reuses one password for every game or an older parent with a single email address used everywhere can all be exposed. Spend 5 minutes running the same checks on their main email addresses, with their permission, and help them turn on the built-in password alerts on their phones. If you share accounts, a shared folder in a password manager is far safer than a reused password everyone remembers.

Step 4: Fix things in the right order

You probably can’t fix everything tonight, so start with what matters most.

1. Your main email account. Email is the master key, because password reset links go there. Change the password if it’s been leaked or reused, and turn on two-factor authentication.
2. Banking, payment and investment accounts. Use unique passwords and the strongest sign-in option offered.
3. Your Apple, Google or Microsoft account. These control your phone, backups and saved passwords.
4. Social media and messaging. Hijacked accounts are used to scam your friends.
5. Shopping sites with saved cards. Change reused passwords and remove saved cards you don’t need.
6. Everything else, in batches, as you sign in over the next few weeks.

For each important account:

• Use a unique password generated by your password manager.
• Turn on two-factor authentication, ideally with an authenticator app or security key rather than SMS.
• Switch to passkeys where available, since there’s no password to leak.
• Sign out other sessions and check for unfamiliar devices in the account’s security settings.

Step 5: Watch for signs someone already got in

If a leaked password was in use, look for clues that someone used it:

• Password reset emails you didn’t request
• New email forwarding rules or filters you didn’t create
• Login alerts from unfamiliar locations or devices
• Sent messages, posts or purchases you didn’t make
• Changes to your recovery phone number or email

If you see any of these on your email account, follow our steps for what to do if your email is hacked. If sensitive personal data like your Social Security number was exposed, use our data breach checklist and consider a credit freeze.

Where to start in the next 15 minutes

1. Check your main email at Have I Been Pwned and sign up for alerts.
2. Open Google Password Checkup or your iPhone’s Passwords app and look at the compromised list.
3. Change your email account password if it’s flagged or reused, and turn on two-factor authentication.
4. Do the same for your bank.
5. Schedule 15 minutes next weekend to work through the rest of the compromised list.

The bottom line

Checking whether your email or password was leaked is free and fast: Have I Been Pwned for your email address, and your built-in password checker for saved passwords. The breach itself is out of your control. What you control is whether a leaked password still works anywhere. Retire leaked and reused passwords, starting with email and banking, add two-factor authentication and let your password manager keep watch from here.

Sources

• Have I Been Pwned: FAQs — how the breach search, Pwned Passwords and notifications work
• Apple Support: Change weak or compromised passwords on iPhone — Detect Compromised Passwords and security recommendations
• Google Search Help: Learn about updates to dark web report — dark web report shutdown dates and replacement tools
• Mozilla Support: Get started with Mozilla Monitor — free breach scans using Have I Been Pwned data
• Google Password Manager: Password Checkup — checking saved passwords for leaks, reuse and weakness