Tech

How to Check If Your Email Password Leaked in a Breach

Rive News Research Desk

Published October 16, 2026 · 9 min read

Key takeaways

Search your email on Have I Been Pwned to see which known breaches exposed it and what data each one took.
Test passwords separately with the Pwned Passwords check, which never sends your full password anywhere.
Change the breached password everywhere you reused it, starting with email, then switch on two-factor authentication.

A data breach notice rarely tells you the full story. It says some data leaked, then leaves you to work out what to do next. The check itself takes about a minute, and the cleanup has a clear order that keeps the most valuable accounts safe first.

This article explains how to check if your email password leaked in a breach, including how to check the email address, how to check the password itself, and what to fix in what order.

A laptop computer on a deskPhotograph: PXHERE / Wikimedia CommonsImage: Wikimedia Commons

What a breach check actually tells you

A breach check compares your email address against databases of credentials that surfaced in known breaches. It does not scan the whole internet, and it cannot see breaches nobody has found yet. A clean result means your address is not in the breach data the service knows about, not that it never leaked anywhere.

Have I Been Pwned is the best-known free service for this check. Security researcher Troy Hunt created it in 2013, and it now holds records from thousands of breaches. You type in an email address, and it lists each breach where that address appeared, with the date and the types of data exposed.

Each breach entry matters because the exposed data decides your next move. An email-only breach mostly means phishing risk. A breach that exposed passwords means you must change that password everywhere you reused it.

A breach that exposed identity numbers or bank details needs stronger steps, which we cover below.

Step 1: Check your email address

Type haveibeenpwned. com into your browser yourself. Do not click a link in an email or an ad to reach it, because lookalike sites exist.

Enter one email address in the search box on the homepage and click Check.

You will get one of two answers. "Good news, no pwnage found" means your email was not in any breach the service knows about. "Oh no, pwned" means it appeared in one or more breaches, and the site lists each one.

Read every breach in the list. For each one, note the date it happened and the compromised data, meaning the types of information that leaked. The 2013 Adobe breach is a classic example: it exposed email addresses, password hints, passwords, and usernames.

That combination is far more serious than an email-only leak.

Repeat the check for every address you use. Old school accounts, old work accounts, and that embarrassing address from years ago often show up in the oldest and messiest leaks. Attackers do not care whether you still use the account.

They care whether you reused its password somewhere that matters.

You can also sign up for the free Notify Me option. It sends you an email if your address appears in a future breach, so you hear about new leaks without remembering to recheck. This kind of routine check pairs well with the habits in our guide to two-factor authentication.

Step 2: Check your passwords separately

Checking your email tells you where your address appeared. It does not tell you whether a specific password is already circulating. For that, use the Pwned Passwords check on the same site.

This check is built around a privacy trick called k-anonymity. Your password is turned into a SHA-1 hash inside your browser, and only the first five characters of that hash are sent to the service. The service returns every hash that starts with those characters, and the final comparison happens on your own device.

Your full password is never transmitted or stored.

The result tells you how many times that password has appeared in leaked databases. If your password has been seen thousands of times, treat it as public. Attackers add these leaked passwords to wordlists and try them against many accounts, a technique called credential stuffing.

Test every password you actually reuse, not just the one on the breached account. A password that leaked from an old forum is just as dangerous on your bank account if you used it in both places. Any password that shows up in the check needs replacing everywhere it appears.

Step 3: Change passwords in the right order

Do not try to change every password in one sitting. Work through the accounts that give an attacker the most power first, because a single compromised account can unlock the rest.

Start with your email account. Email is the master key: anyone inside your inbox can request password resets on almost every other service you use. Change that password first, and make it long and unique.

Next, change banking and financial accounts. Then move to cloud storage, where private documents live, and then to social media accounts, which attackers use to scam your contacts. After those four groups are safe, work through shopping, streaming, and forum accounts at a steadier pace.

The FTC gives the same advice in its data breach guidance: change passwords right away, especially the password you used with the breached company and on any account using a similar password. The FTC also suggests a password manager to create complex and unique passwords you do not have to memorize.

Use a different password for every important account. Reuse is the habit that turns one small breach into a full account takeover. In the FTC's case against delivery platform Drizly, the FTC alleged that a hacker got in by reusing an executive's seven-character password that had been made public in an unrelated breach, exposing personal information from 2.5 million Drizly users.

One short, reused password opened the door to millions of records.

Step 4: Turn on two-factor authentication

A changed password is only half the fix. Two-factor authentication adds a second check at login, such as a code from an authentication app or a security key. Even if your password leaks again, the attacker still needs that second factor.

Turn it on first for email, banking, cloud storage, and social media. Authentication apps beat text-message codes when you have the choice, because text messages can be intercepted through SIM-swap attacks. A hardware security key is stronger still for your most sensitive accounts.

Save your backup codes somewhere safe when you set up two-factor authentication. Print them or store them in your password manager. If you lose your phone without backup codes, recovering the account becomes a slow process, and some services make it deliberately hard to prove you are the owner.

If you want the full setup walkthrough, see our guide on two-factor authentication.

Step 5: Handle the harder cases

Most breaches expose email addresses and passwords. Some expose far more, and those need extra steps beyond a password change.

If a Social Security number or other government ID number leaked, visit IdentityTheft. gov, the FTC's recovery site, and follow its data breach guidance. Consider placing a credit freeze with the three major credit bureaus, which is free in the United States and blocks new accounts from being opened in your name.

If bank or card details leaked, contact your bank directly and ask about replacing the card and watching for unauthorized transactions.

Expect targeted phishing after any breach. Attackers use real breach details to make fake messages look convincing, and they may already know your name, your address, or which service you used. Treat any message about the breach with suspicion, especially one asking you to click a link or enter a password.

Go to the service yourself by typing its address, the same way you reached the breach check.

Watch your accounts for months, not days. Stolen data often circulates for a long time before anyone uses it. A quick scan of bank statements and login alerts each week catches misuse far earlier than waiting for a yearly review.

For a broader look at staying safe on risky networks, read our guide on how to tell if a public Wi-Fi network is safe to use.

What a clean result does and does not mean

A clean result is good news, but it has limits. The check only covers breaches whose data has been found and loaded into the service. Some breaches involving sensitive data are hidden from public search and shown only to the verified owner of the address.

A breach that happened yesterday may not appear for weeks.

That is why the habits matter more than any single check. Unique passwords, two-factor authentication, and a password manager protect you even from breaches you never hear about. The check tells you where to act today.

The habits protect you against the breaches you will never see.

Recheck your main addresses every few months, and recheck immediately after any breach notice. Five minutes of checking, plus an hour of password changes, can save weeks of recovery work later. For more on how attackers exploit leaked credentials, see our explainer on end-to-end encryption.

Fingers resting on a computer keyboardPhotograph: Cangjie6 / Wikimedia CommonsImage: Wikimedia Commons

A padlock with a chainPhotograph: Lacz02 / Wikimedia CommonsImage: Wikimedia Commons

How often should I check for breaches?

Check your main email addresses every few months, and immediately after any breach notice. Signing up for breach alerts covers the gaps between manual checks.

Is it safe to type my password into a breach checker?

The Pwned Passwords check is designed so your full password never leaves your browser. Only the first five characters of its hash are sent. Never type a password into a random site that is not a well-known checker.

What if my email was in a breach but my password was not?

Change the password anyway if you reused it anywhere, and stay alert for phishing. An exposed email address still helps attackers craft convincing scams aimed at you.

Should I delete an old account that was breached?

If you no longer use the account and it holds no data you need, closing it removes a future target. Change its password first if you reused that password anywhere else.

The bottom line

Check your email on Have I Been Pwned, test your reused passwords with Pwned Passwords, then change passwords starting with email and banking, and switch on two-factor authentication. A clean result is reassuring, but unique passwords and two-factor authentication are what protect you against the next breach.

Tags: data breach, password security, email security, two-factor authentication

Latest in Tech

Subscribe for one practical security tip each week, written in plain English.

Taggeddata breachpassword securityemail securitytwo-factor authentication