Accounts & passwords
How to check whether your email or password has been leaked
Billions of email addresses and passwords have been exposed in data breaches over the years. Most people’s details are in at least one. Checking takes a minute, and the result tells you which passwords need changing first.
The short version
Quick check
- Check your email on Have I Been Pwned.
- Run the password check in your browser or password manager.
- Change any leaked or reused passwords, starting with email.
- Turn on two-step verification on important accounts.
Why it matters
When a website is breached, attackers often get email addresses and passwords. Those lists are shared and fed into tools that try the same combinations on email, banking, shopping and social media sites. If you’ve reused a password, one old breach can unlock accounts you care about today.
Check your email address
Have I Been Pwned is a free, widely trusted service run by Australian security researcher Troy Hunt. Type in your email address and it lists the known breaches it appears in, and what kind of data was exposed.
- “Good news, no pwnage found” means it isn’t in the breaches the service knows about. It’s not a guarantee, but it’s a good sign.
- A list of breaches tells you which services lost your details and when. Look at what was exposed: passwords, phone numbers, addresses, dates of birth.
You can also sign up for free alerts so you’re told about future breaches.
Check your saved passwords
Your browser or password manager can check your saved passwords against known breaches without sending them in a readable form.
| Tool | Where to find it |
|---|---|
| Google Password Manager (Chrome, Android) | Visit passwords.google.com and run the Password Checkup |
| Apple Passwords (iPhone, Mac) | Open the Passwords app and look at Security recommendations |
| Microsoft Edge | Settings, then Passwords, and look for Password Monitor |
| Password managers like Bitwarden or 1Password | Look for a security report or Watchtower-style check |
These tools also flag passwords that are weak or reused, which matter just as much.
Never type your password into a random “check my password” website
Only use Have I Been Pwned or the tools built into your browser and password manager. Fake checkers exist to collect passwords.
What to do with the results
Start with the accounts that matter
Change passwords for your email, banking, myGov, Apple, Google or Microsoft account, and anything flagged as leaked. Then work through the rest.
Make every password unique
The leak itself is only a problem if the password still works somewhere. A password manager makes unique passwords easy.
Turn on two-step verification
So a leaked password isn’t enough on its own. See our two-step verification guide.
Close accounts you don’t use
Old accounts are easy to forget and often have reused passwords. Delete them if you can.
Watch for targeted scams
If your phone number or address was exposed, expect more scam texts and calls. See what to do after a data breach notice.
For businesses
- Check your company domain on Have I Been Pwned’s domain search to see staff addresses in breaches.
- Require MFA for every staff account so leaked passwords alone can’t be used.
- Use a business password manager so staff don’t reuse personal passwords for work.
Common questions
My email is in a breach from years ago. Does it still matter?
Only if you still use that password anywhere. Change it wherever it’s used and move on.
Is it safe to enter my email on Have I Been Pwned?
Yes. It’s a long-running service used and recommended by governments and security teams. It only needs your email address, never your password.
Should I change all my passwords every few months?
Not necessarily. Current advice focuses on long, unique passwords and MFA, and changing them when there’s a reason, such as a breach.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.