Your details may already be in a leaked list. It takes only a few minutes to find out, and you can do it without exposing any real password. This how-to belongs to our guide to data breaches and hacked accounts.
Step 1: Check your email address
Go to a trusted service such as Have I Been Pwned, typing the address yourself. Enter your email address. It shows which known breaches included that address and what kinds of data were exposed.
Try every email address you have used, including old ones.
Step 2: Run your password manager's check
Most managers and browsers include a security report that flags passwords that have appeared in leaks, along with weak and reused ones.
- Password manager: look for "Watchtower", "Security dashboard", "Vault health" or similar.
- Chrome: look in the password manager's Checkup.
- Apple: look for Security Recommendations in the Passwords app.
These tools work without sending your real password to anyone.
Step 3: Decide what to fix first
| Exposure | Priority |
|---|---|
| Password for email or banking | Now |
| A password you reused elsewhere | Now |
| Password for an old forum you never reuse | Soon |
| Email address only | Stay alert for scams |
| Card details | Call your bank |
| Government ID numbers | See IdentityTheft.gov if you are in the US |
Step 4: Replace affected passwords
Use your password manager to generate a new one for each affected account. Then follow our full breach response steps, and add two-factor login.
What a clean result means
A clean result only means that your details are not in the breaches that the service knows about. New leaks appear all the time, and some are never reported. Keep using unique passwords whatever the result.
Turn on alerts
Many services, including Have I Been Pwned, can email you if your address appears in a new breach. Be aware that scammers imitate these alerts, so always open the service directly. See fake password reset emails and alerts.