Was Your Password Leaked? Check in 2 Minutes

Learning how to check if your password was leaked in a data breach takes about two minutes, and it is one of the highest value security habits you can build. Billions of login credentials circulate in breach databases right now, and most people have no idea theirs are among them. The danger is not just someone logging into an old forum account. Leaked passwords get tested automatically against banks, email providers, and shopping sites within hours, a tactic called credential stuffing. This guide shows you the two free checks that matter, how to read the results without panicking, and exactly what to fix first.

Read More: Is That Text a Scam? 9 Warning Signs to Check

Run the Two Free Checks First

Here is the mistake most people make: they check their email address on a breach lookup site and stop there. That tells you which leaks your address appeared in, but it says nothing about whether a password you still use today is sitting in a criminal’s spreadsheet. You need two separate checks, one for your email and one for your passwords. Both are free, and together they take less time than brewing coffee.

Check your email on Have I Been Pwned

Have I Been Pwned is the standard breach lookup, run by security researcher Troy Hunt. Type the site address into your browser yourself rather than clicking a link from an email, then enter one email address and run the search. No account needed, no payment, no catch.

The results list every breach your address appeared in, with the company name, the date, and which types of data leaked. Pay attention to the data types. A breach that exposed only email addresses is a nuisance. One that exposed passwords, or a “stealer log” entry (meaning infostealer malware grabbed logins directly from an infected device), deserves your immediate attention. Repeat the search for every email address you have used in the last decade, including old school accounts and work addresses. Then sign up for the free “Notify me” alert on the site so you get an email the next time your address turns up in a new breach. You only want to do this manual trawl once.

Simple idea: keep a note on your phone listing every email address you have ever used, oldest first. The next time you run a breach check, perhaps once a year, you will not have to reconstruct the list from memory.

Check your actual passwords with the tool you already own

Your email check cannot tell you whether a password you use today is compromised. For that, use the password checker built into the device or browser you already have. On iPhone, iPad, or Mac, open the Passwords app and tap Security. It flags passwords that are weak, reused, or have appeared in known leaks. Make sure Detect Compromised Passwords is switched on in Settings so you get warned about new leaks automatically.

On Chrome or Android, head to passwords.google.com, choose Password Checkup, and run the scan. It marks each saved password as exposed, weak, or reused. If you use a dedicated password manager, look for a section called Watchtower, Security, or Health Report. Most paid managers run the same kind of check, and Bitwarden’s free tier includes a basic breach report for your email address.

Change every password marked as exposed first, starting with email, banking, and social media accounts. Then work through the reused ones. A reused password is nearly as dangerous as a leaked one, because a single breach hands attackers the key to every account that shares it.

Triage the results by severity, not by date

A long breach list looks alarming, but not every entry demands action. Sort by what leaked, not by when it happened. An old breach from 2019 still matters if you reused that password somewhere and never changed it. A recent breach that exposed only your name and email mostly means you should expect more convincing phishing attempts, since scammers now have the details to make fake messages look real.

Work in this order. First, any password you still use that appears in a leak: change it immediately, everywhere you used it. Second, reused passwords flagged by your password checkup, even if no leak is confirmed. Third, accounts where only contact details leaked: no password change needed, but stay sharp for phishing. If your phone number leaked, expect a rise in spam calls, which is worth knowing about before it starts. Our guide to reporting spam calls in the US walks you through shutting those down at the source instead of just blocking numbers one by one.

There is one special case. If a breach exposed your Social Security number, email lookups alone will not protect you. Place a free credit freeze with each of the three major US bureaus (Equifax, Experian, and TransUnion). A freeze blocks new accounts from being opened in your name, and under US law it costs nothing and you can lift it temporarily whenever you need credit yourself.

Lock down whatever leaked

Checking is only half the job. Once you know what is exposed, close the gaps methodically. Change compromised passwords to something long and unique; a password manager can generate and store them so you never have to memorise anything. A passphrase of four or five random words works well for the few passwords you type by hand.

Next, switch on two-factor authentication for your email, bank, and social accounts. An authenticator app beats SMS codes, because text messages can be intercepted through SIM swapping. Your email account deserves priority here: it is the master key, since password resets for everything else flow through it. Where a site offers passkeys, take the option. A passkey cannot be phished or leaked in a breach, because there is no password to steal in the first place.

Finally, prune ruthlessly. Close old accounts you no longer use, starting with the ones that appeared in breach results. Every dormant account is a future breach waiting to happen, and most services let you delete your data along with the account. Fewer accounts means a smaller attack surface and fewer passwords to manage.

Here is what sorting this out actually costs:

• Have I Been Pwned email search plus breach alerts: $0
• Google Password Checkup or the iPhone Passwords app security scan: $0
• Credit freeze at all three US bureaus: $0
• Bitwarden free password manager: $0
• Bitwarden Premium with advanced breach reports: $10 per year
• 1Password individual plan with Watchtower monitoring: about $36 per year

Total: $0 if you stick with the free tools, which cover everything most people need. The paid managers buy convenience and nicer reports, not fundamentally better protection.

Conclusion

Checking whether your password leaked is a two minute job with an outsized payoff. Search your email addresses on Have I Been Pwned, scan your saved passwords with the checker you already own, and fix what you find in severity order: exposed passwords first, reused ones second, then two-factor authentication and a credit freeze where relevant. The free tools do the whole job, so there is no reason to put it off.

Breaches will keep happening no matter how careful you are, because the weak link is usually a company’s servers, not your behaviour. What you control is the blast radius. Unique passwords, two-factor authentication on the accounts that matter, and breach alerts switched on mean the next headline breach is someone else’s emergency, not yours.