How to Check If Your Password Has Been Leaked (Step-by-Step)

Why You Need to Check for Leaked Passwords

Data breaches happen constantly. In 2024 alone, over 3,200 publicly reported breaches exposed more than 8 billion records worldwide. These stolen credentials don't just sit idle — they're actively traded on dark web marketplaces, compiled into massive "combo lists," and used in automated credential stuffing attacks within hours of a breach.

Here's the alarming part: most people don't know they've been breached. Companies sometimes take months or years to disclose breaches (if they disclose them at all). Meanwhile, attackers are testing your email and password combination against every major service — your bank, your email provider, your social media, your Amazon account.

If you've ever reused a password (and 65% of people do, according to Google's 2024 security survey), a single breach at one service can compromise every account that shares that password.

Understanding Breach Databases

When a company gets breached, the stolen data typically follows this path:

1. Exfiltration: Attackers copy databases containing usernames, email addresses, passwords (sometimes hashed, sometimes in plain text), and other personal data.
2. Private sale: The data is sold on dark web forums to the highest bidder, often within days of the breach.
3. Combo list compilation: Buyers combine data from multiple breaches into massive lists sorted by email address or username.
4. Credential stuffing: Automated tools test these email/password pairs across hundreds of popular websites at scale — sometimes millions of login attempts per hour.
5. Public release: Eventually, many breach datasets become freely available, appearing on paste sites, forums, and aggregator databases.

Security researchers monitor these channels and compile breach data into searchable databases so you can check whether your credentials have been exposed. The most trusted of these is HaveIBeenPwned.

Step 1: Check Your Email on HaveIBeenPwned

HaveIBeenPwned (HIBP), created by security researcher Troy Hunt, is the gold standard for breach checking. It aggregates data from over 800 breached sites and 14 billion compromised accounts.

1. Go to haveibeenpwned.com
2. Enter your email address in the search bar.
3. Click "pwned?" to check.
4. Review the results. You'll see a list of every known breach that included your email address, along with what data was exposed (passwords, phone numbers, addresses, etc.).

Repeat this for every email address you use. Most people have 2-3 email addresses, and each may appear in different breaches.

Step 2: Check If a Specific Password Was Leaked

HIBP also lets you check individual passwords — and it does this without ever seeing your actual password.

1. Go to haveibeenpwned.com/Passwords
2. Enter the password you want to check.
3. The site will tell you how many times that password has appeared in breach datasets.

How This Works (Safely)

HIBP uses a technique called k-anonymity to check your password without transmitting it:

• Your password is hashed (converted to a SHA-1 string) locally in your browser.
• Only the first 5 characters of the hash are sent to the server.
• The server returns all hashes in its database that start with those 5 characters (typically 400-600 matches).
• Your browser checks locally whether the full hash matches any in the returned list.

The result: the HIBP server never sees your full password or its complete hash. The check is mathematically safe.

Step 3: Set Up Breach Notifications

Checking manually is good, but automated monitoring is better. Here's how to set up continuous alerts:

• HIBP email notifications: On HaveIBeenPwned, click "Notify Me" and enter your email address. You'll receive an alert whenever your email appears in a newly loaded breach.
• Password manager Watchtower: 1Password's Watchtower and NordPass's breach scanner continuously compare your saved credentials against breach databases and flag compromised passwords directly in your vault.
• Google Password Checkup: If you use Chrome, Google automatically checks saved passwords against known breaches and displays warnings in Settings > Passwords.
• Firefox Monitor: Mozilla's breach monitoring tool, powered by HIBP data, sends alerts for emails you register.

Step 4: What to Do If Your Password Was Leaked

Don't panic — but act quickly. Here's your action plan:

Immediate Actions (Do These Now)

1. Change the compromised password immediately. Log into the breached service and update your password. Use your password manager to generate a random 20+ character password.
2. Change the password everywhere you reused it. This is the critical step most people skip. If you used the same password on your email, bank, or social media, change all of them. Your password manager can identify reused passwords instantly.
3. Enable two-factor authentication (2FA) on the breached account and all accounts that share the old password. Use an authenticator app (Google Authenticator, Authy) rather than SMS.
4. Check for unauthorized activity. Review the breached account for unfamiliar logins, changes to settings (especially recovery email/phone), or unauthorized transactions.
5. Revoke active sessions. Most services have a "sign out of all devices" option in security settings. Use it to kick out anyone who may have accessed your account.

Follow-Up Actions (Do These Within 48 Hours)

• Check your email for suspicious activity. If your email password was reused, attackers may have used it to access your inbox and reset passwords on other services.
• Review financial accounts for unauthorized charges, even small ones. Criminals test with micro-transactions before larger theft.
• Monitor your credit report for new accounts you didn't open. Consider placing a credit freeze if sensitive data like your SSN was in the breach.
• Update security questions. If the breach exposed answers to common security questions, update them on all accounts that use them.

How Password Managers Prevent This Problem

The entire leaked password crisis exists because of one behavior: password reuse. If every account has a unique password, a breach at one service affects only that one service. Here's how password managers solve this systematically:

Other Breach Checking Tools Worth Knowing

• DeHashed (dehashed.com): A searchable breach database that lets you search by email, username, IP address, name, phone number, and more. Some features require a paid subscription.
• Intelligence X (intelx.io): An advanced search engine that indexes breached data, paste sites, and dark web content. Used primarily by security professionals and journalists.
• Google One Dark Web Report: Available to Google One subscribers, this scans the dark web for your personal information including email, SSN, and phone number.
• Mozilla Monitor (monitor.mozilla.org): Free service powered by HIBP data with a clean interface and email notifications.

For most people, HIBP combined with a password manager's built-in monitoring provides comprehensive coverage without needing specialized tools.

How to Stay Protected Going Forward

1. Use a password manager — make every password unique and let Watchtower monitor for breaches automatically.
2. Enable 2FA on all important accounts — even if a password leaks, 2FA blocks unauthorized access.
3. Subscribe to HIBP notifications — free alerts whenever your email appears in a new breach.
4. Use email aliases — services like 1Password's email masking or SimpleLogin let you use a unique email address for every service, making it harder to link your accounts across breaches.
5. Never reuse passwords — this is the single behavior that turns a minor breach into a catastrophe.