How to Check if Your Email or Password Was in a Data Breach (and What to Do Next)
Free, trustworthy ways to check whether your email or passwords appeared in data breaches, what the results mean, and a step-by-step clean-up plan.
Some links in this guide are affiliate links: if you buy, TechForLive may earn a commission at no extra cost to you. Details.
Why it matters
Large companies are breached regularly, and stolen email and password lists are traded and reused. Criminals try those combinations on other sites ("credential stuffing"). If you reuse a password, one breach can unlock many accounts.
Trustworthy free tools
| Tool | What it checks |
|---|---|
| Have I Been Pwned | Whether your email appears in known breaches, and which ones. Run by security researcher Troy Hunt since 2013; you can sign up for free notifications. |
| Google Password Manager › Password Checkup | Saved passwords that are compromised, reused or weak |
| Apple Passwords › Security recommendations | Saved passwords found in leaks or reused |
| Firefox Monitor / password manager reports | Breach alerts for your emails and saved logins |
Your clean-up plan
- Secure your email first. Change its password to a long, unique one and turn on two-factor authentication or a passkey. Email is the key to resetting everything else.
- Change passwords for the breached site and every site where you reused that password.
- Prioritise money and identity: banking, PayPal, shopping, mobile carrier, government accounts.
- Turn on passkeys or 2FA wherever offered. See what a passkey is.
- Use a password manager so every site gets a unique password you never have to remember.
- Watch for follow-up scams: breached data fuels convincing phishing. Our phishing guide shows the signs.
- If ID numbers or card details leaked, contact your bank and consider a credit freeze where available.
What the results mean
- "Oh no, pwned!" means your email appeared in at least one breach. It does not mean your account is hacked right now.
- Check what data was exposed: email only, passwords (hashed or plain), phone numbers, addresses. That tells you what to change.
- Old breaches still matter if you have not changed that password since.
Quick answers
Is Have I Been Pwned safe to use?
Yes. It is widely used and recommended by security professionals and even government agencies; searching your email does not expose your data.
My email was in 10 breaches. Should I make a new one?
Not necessarily. Secure it with a strong password and 2FA, use unique passwords everywhere, and filter spam. A new address is only worth it if spam becomes unmanageable.