If you have used the internet for more than a few years, the odds are high that at least one of your passwords has appeared in a data breach. More than 14 billion compromised credentials are now indexed across hundreds of disclosed breaches, and attackers actively replay them against other sites. The question is not really whether you have been caught up in a breach, but which accounts are exposed and what to do about it. This guide shows you how to check safely and how to respond.

How breach checking works without exposing you

A reasonable worry: if I type my password into a website to check it, am I not just handing it over? Reputable breach-check services solve this with a clever technique called k-anonymity, and it is worth understanding so you can trust the result.

Instead of sending your password, the tool hashes it locally and sends only the first five characters of that hash to the server. The server replies with every leaked hash that shares those five characters — often hundreds of them — and your browser checks the rest of the match locally. The service never sees your actual password or even its full hash. Your secret never leaves your device in a usable form.

The golden rule: only ever check a password on a tool that uses this hashed, partial-match approach. Never paste a real password into a random site that asks for it in full.

Step 1: Check your email addresses

The fastest first pass is to search your email addresses. Have I Been Pwned (haveibeenpwned.com) is the long-standing, independent, free service for this. Enter an address and it lists every known breach that included it, what data was exposed (passwords, phone numbers, security questions), and when. Check every address you use, including old ones.

If an address appears in a breach that exposed passwords, treat every account that used that password as compromised — not just the breached site, because of credential stuffing.

Step 2: Check individual passwords

Knowing an email was breached tells you that you are exposed; checking a specific password tells you whether that exact secret is already in attackers' wordlists. Have I Been Pwned's Pwned Passwords feature lets you check a password using the k-anonymity method described above. If a password shows up even once, retire it everywhere immediately — a leaked password is permanently burned, no matter how strong it looks.

Step 3: Use the tools you already have

You probably own breach-checking features without realizing it:

  • Your browser. Chrome, Edge, Safari, and Firefox all monitor saved passwords against breach databases and warn you about leaked or reused ones. Look for the password checkup or security recommendations in settings. The trade-offs of relying on the browser are covered in is it safe to save passwords in your browser.
  • Your password manager. Bitwarden, 1Password, and others include a vault health or watchtower report that flags breached, weak, and reused passwords in one place. This is the most efficient way to audit dozens of accounts at once — another reason a dedicated manager is worth using.

What to do if a password was leaked

Finding a leak is good news in disguise — now you can act. Work through this checklist for each affected account:

  • Change the password immediately on the breached account, and generate a fresh, unique, high-entropy replacement. Do not reuse any variation of the old one.
  • Change it everywhere you reused it. If the leaked password was shared across sites, every one of those accounts is now at risk. This is the moment that reuse becomes expensive.
  • Turn on two-factor authentication. A leaked password with two-factor authentication enabled is far less dangerous. Prefer an authenticator app over SMS.
  • Watch for follow-on phishing. Breached data often includes your name and email, which fuels targeted phishing. Be extra skeptical of messages referencing the breached service.
  • Check related accounts. If your primary email was exposed, prioritize it — email controls password resets for everything else.

Step 4: Set up ongoing monitoring

Checking once is a snapshot; breaches happen continuously. Make monitoring automatic:

  • Register your email addresses for free breach notifications on Have I Been Pwned so you are alerted the moment a new breach includes you.
  • Enable breach alerts in your password manager and browser.
  • When an alert arrives, change the affected password and anything that shares traits with it.

Key takeaways

  • Assume exposure. With billions of credentials leaked, the realistic question is which accounts, not whether.
  • Check safely. Only use tools that rely on hashed, k-anonymity matching; never paste a full password into an unknown site.
  • Leaked means dead. Retire any leaked password everywhere, instantly.
  • Automate it. Sign up for breach alerts so future leaks reach you fast.

The best long-term defense is to make any single leak harmless: a unique, strong password per account plus two-factor authentication means one breach can never cascade. Generate replacements with our free password generator or build a memorable passphrase you can actually recall, store them in a manager, and let breach monitoring watch your back.