How to check if your passwords have been leaked

When a website gets hacked, the email addresses and passwords stored there often end up circulating for years afterward. The scary part is how ordinary it is — most people appear in several breaches without ever knowing. The good news: checking takes about two minutes.

Step 1 — Check your email against known breaches

Go to haveibeenpwned.com, a free, well-respected service run by security researcher Troy Hunt, and enter your email address. It will list every known breach your address appeared in and what was exposed — email, password, phone, date of birth, and so on. Do this for every email address you use.

Step 2 — Find out if a password itself leaked

A breach that only exposed your email is annoying; one that exposed a password you still use is urgent. Most modern browsers and password managers now flag reused or compromised passwords automatically:

• Chrome / Edge: Settings → Autofill → Passwords → "Check passwords."
• Safari / iCloud Keychain: Settings → Passwords → Security Recommendations.
• Password managers (1Password, Bitwarden, etc.) have a built-in breach/health report.

Step 3 — Fix the urgent ones first

1. Change any breached password that is still in use — starting with email, banking, and anything tied to money or identity.
2. Stop reusing passwords. A leak only becomes a disaster when the same password unlocks ten other accounts. A password manager makes unique passwords effortless.
3. Turn on two-factor authentication (2FA) everywhere it is offered. Even a leaked password is far less useful to an attacker if a second step is required.

Step 4 — Keep watching

New breaches happen constantly, so a one-time check is only a snapshot. You can turn on free breach notifications at haveibeenpwned.com, or use a service that monitors continuously and tells you the moment your details show up somewhere new.

This guide is general information, not security or legal advice. Tools and menus change over time; check the current options in the apps you use.