How to Check if Your Password Has Been Leaked or Breached

Data breaches happen every day, and billions of credentials have been exposed on the dark web. If you’ve ever used the same password on multiple sites (and most people have), there’s a real chance one or more of your passwords has been leaked. Here’s how to find out — and what to do about it.

Why You Should Check for Password Leaks

When a company gets hacked, attackers often steal the database of usernames and passwords. These credentials end up on the dark web, where other criminals buy them for use in attacks.

The danger isn’t just the breached service — it’s credential stuffing. Attackers take leaked password combinations and automatically try them on hundreds of other services: your email, your bank, your social media, your Amazon account. If you’ve reused a password anywhere, every account using that password is at risk.

The statistics are alarming:

Over 24 billion username/password pairs are available on the dark web
59% of people reuse passwords across accounts
Credential stuffing accounts for billions of login attempts monthly
The average person won’t know they’ve been breached for 194 days

How to Check if Your Password Has Been Leaked

Method 1: Have I Been Pwned (HIBP)

Have I Been Pwned is the gold standard for breach checking, created by security researcher Troy Hunt.

How to use it:

Go to haveibeenpwned.com
Enter your email address
Click “pwned?”
Review the results — it shows which breaches your email appeared in

Password-specific check:

Go to haveibeenpwned.com/Passwords
Enter a password to check
HIBP uses a technique called k-anonymity — it hashes your password locally, sends only the first 5 characters of the hash to the server, and compares the rest locally. Your actual password is never transmitted.

Results:

“Oh no — pwned!” = your email/password was found in a breach
“Good news — no pwnage found!” = not found in known breaches

Method 2: Google Password Checkup

If you use Google Chrome or have a Google account:

Go to passwords.google.com
Click “Go to Password Checkup”
Sign in to your Google account
Google will check all your saved passwords against known breach databases
Review results: compromised, reused, and weak passwords

This is particularly useful because it checks all your saved passwords at once and categorizes them by risk level.

Method 3: Browser Built-in Monitoring

Modern browsers have built-in breach monitoring:

Chrome: Settings → Privacy → Security → Enhanced protection (automatically alerts you)
Firefox: firefox.com/lockwise → Monitor (uses HIBP data)
Safari: Settings → Passwords → Security Recommendations
Edge: Settings → Profiles → Passwords → Password monitor

Method 4: Password Manager Breach Monitoring

Most password managers include breach monitoring:

Bitwarden: Vault Health Reports (check exposed passwords)
1Password: Watchtower (monitors breaches automatically)
Dashlane: Dark Web Monitoring (scans the dark web for your info)
NordPass: Data Breach Scanner

See our complete password manager guide for details on each.

Method 5: Email Breach Notifications

Some services proactively notify you:

Google: Sends alerts when your saved passwords are found in breaches
Apple: iCloud Keychain sends “compromised password” notifications
Firefox Monitor: Free email notifications from Mozilla

What to Do if Your Password Has Been Leaked

If you discover a breached password, act immediately:

Step 1: Change the Compromised Password

Go to the affected service and change your password immediately. Use our password generator to create a strong, unique replacement.

Step 2: Change Reused Passwords

If you used the compromised password on ANY other service, change those passwords too — each to a unique, random password.

Step 3: Enable Two-Factor Authentication

Add two-factor authentication to all affected accounts. Even if an attacker has your new password, 2FA prevents access.

Step 4: Check for Unauthorized Activity

Review recent login history, transactions, and account activity on affected services. Look for:

Logins from unfamiliar locations or devices
Emails you didn’t send
Password reset requests you didn’t initiate
Unfamiliar transactions or purchases

Step 5: Start Using a Password Manager

If you’re not already using one, this is the wake-up call. A password manager generates and stores unique passwords for every account, eliminating the reuse problem entirely.

How to Prevent Future Password Leaks

While you can’t prevent a company from getting breached, you can minimize the damage:

1. Use Unique Passwords Everywhere

The #1 protection against credential stuffing. If every account has a unique password, a breach of one service doesn’t affect any others. Use a random password generator for each account.

2. Use a Password Manager

Store all your unique passwords in an encrypted vault. You only need to remember one master password. See our guide.

3. Enable 2FA on Everything

Two-factor authentication blocks 99.9% of automated attacks, even when passwords are compromised. Prioritize email, financial, and social media accounts. Complete 2FA guide.

4. Monitor for Breaches

Set up ongoing monitoring:

Register your email at haveibeenpwned.com for breach notifications
Enable your password manager’s breach monitoring features
Turn on Google/Apple password alerts

5. Use Long, Random Passwords

Even if a breach exposes your hashed password, a long random password (16+ characters) is extremely difficult to crack from the hash. Use our strong password generator.

6. Don’t Use Personal Information in Passwords

Birthdates, pet names, addresses, and phone numbers are easily discoverable and commonly used in targeted attacks.

Understanding Password Breach Data

How Breaches Happen

Companies store passwords as hashes (one-way mathematical transformations). When a breach occurs, attackers get the hashed passwords and attempt to reverse-engineer them using:

Brute force: Trying every possible combination
Dictionary attacks: Testing common words and patterns
Rainbow tables: Pre-computed hash lookups
Rule-based attacks: Applying common modifications to dictionary words

What Affects Your Risk

Your password’s vulnerability depends on:

The hashing algorithm the service used (bcrypt is strong, MD5 is weak)
Whether a salt was used (salting prevents rainbow table attacks)
Your password’s strength — a random 16-character password is virtually uncrackable, even from a leaked hash

The BCrypt Advantage

Services that use BCrypt or Argon2 for hashing make it extremely difficult to crack passwords from stolen hashes. Unfortunately, you can’t control which algorithm a service uses — so always use strong passwords as your own protection.

Password Security Checklist

Use this checklist to assess your current security posture:

✅ Checked email at haveibeenpwned.com
✅ Run Google/Apple/browser password checkup
✅ Changed all compromised passwords
✅ Eliminated all reused passwords
✅ Using a password manager
✅ 2FA enabled on critical accounts
✅ Using random, unique passwords for every account
✅ Breach monitoring set up (HIBP notifications)
✅ Checked for unauthorized account activity

Take Action Now

Your online security is only as strong as your weakest password. Start by:

Check your passwords: Use the tools above to find compromised credentials
Generate new passwords: Use our free Password Generator — strong, unique, and private
Test your passwords: Verify strength with our Password Checker
Set up protection: Install a password manager and enable 2FA

Don’t wait for the next breach notification. Act now.