Data breaches happen constantly, and there's a fair chance that at least one online service you've signed up for over the years has had its user database stolen and published, whether or not you were ever notified about it. This guide shows you how to check properly, what the results actually mean, and the concrete steps to take if your details turn up.

Checking With Have I Been Pwned

Have I Been Pwned (haveibeenpwned.com) is a free, widely trusted service run by security researcher Troy Hunt, which aggregates data from known breaches and lets you check whether your email address appears in any of them.

  1. Go to haveibeenpwned.com in your browser.
  2. Enter your email address in the search box and click pwned?.
  3. The site will show either a green "Good news, no pwnage found" message, or a red listing of every known breach your address appears in, including the breached service's name, the date of the breach, and what type of data was exposed (passwords, names, addresses, and so on).
  4. Click on any listed breach for more detail about what happened and what data types were compromised.

Privacy tip: Have I Been Pwned does not store the email addresses you search unless you explicitly sign up for its free notification service (described below), and searching your own address is completely safe and doesn't expose it to anyone else.

Setting Up Ongoing Breach Notifications

Checking once is useful, but new breaches are discovered regularly, so ongoing monitoring is more valuable than a one-time check:

  1. On Have I Been Pwned, scroll to the Notify me section and enter your email address.
  2. Confirm via the verification email sent to that address.
  3. From then on, you'll receive an automatic alert whenever that email address appears in a newly added breach.
  4. Repeat this for every email address you actively use, including work addresses if your employer permits it, since each address needs to be registered separately.

Checking Passwords Specifically

Beyond checking your email, Have I Been Pwned also offers a Pwned Passwords tool that checks whether a specific password has appeared in known breach data, without ever transmitting the actual password to their servers (it uses a cryptographic technique called k-anonymity, sending only a partial hash).

  1. Go to the Passwords section of the site.
  2. Enter a password you're considering using or currently use.
  3. If it shows as having appeared in breach data — even a large number of times — treat it as compromised and stop using it anywhere, since it will be one of the first passwords attackers try in automated attacks.

Warning: Never enter your actual current banking or highly sensitive account password into any third-party checking tool, including this one, if you're at all uncertain about the tool's legitimacy. Have I Been Pwned's password checker is well-established and uses privacy-preserving techniques specifically so the full password is never sent, but as a general habit, be cautious about which tools you trust with password input at all.

Built-In Browser Breach Checking

Modern browsers also include their own breach monitoring, checking saved passwords against known breach lists automatically:

  • Google Chrome: Go to Settings > Autofill and passwords > Google Password Manager > Password Checkup (or visit passwords.google.com and click "Check passwords"). This checks all passwords saved in Chrome against known breaches and also flags weak or reused passwords.
  • Microsoft Edge: Go to Settings > Profiles > Passwords, where Edge will show a Password Monitor alert next to any saved password found in a known leak.
  • Apple Safari (iCloud Keychain): On iPhone or Mac, go to Settings > Passwords > Security Recommendations, which flags any saved password that's appeared in a known data breach.

Because these tools check passwords actually saved in your browser, they're a useful complementary check alongside Have I Been Pwned, which checks based on email address across a much broader dataset of historical breaches.

What To Do If Your Email Appears in a Breach

Finding your email in a breach listing is common and not, by itself, cause for panic — but it does require specific follow-up action:

  1. Identify what data was exposed. Have I Been Pwned's breach detail page lists the data types (email only, or email plus password, security questions, addresses, etc.) — this determines how serious the follow-up needs to be.
  2. Change the password for that specific service immediately, and for any other account where you reused the same or a similar password — password reuse is precisely what turns one breach into many compromised accounts.
  3. Enable two-factor authentication (2FA) on the breached service and any related important accounts, if not already active, since this significantly limits what an attacker can do even with a valid password.
  4. Watch for phishing attempts referencing the breach — attackers sometimes use breach data (name, partial address, or purchase history) to craft convincing follow-up scam emails claiming to be from the breached company.
  5. Check whether financial information was exposed. If card details or bank information were part of the breach, contact your bank to discuss monitoring or reissuing the card, even if the breached company claims the data was encrypted.

Pro tip: Use a password manager (built into your browser, or a dedicated app like Bitwarden or 1Password) to generate a unique, strong password for every account. This means a single breach only ever compromises one account rather than cascading into every service where you reused that password.

Understanding "Sensitive" Breaches

Have I Been Pwned marks certain breaches as "sensitive" (for example, breaches from adult websites or services where mere membership could be personally damaging if disclosed) and excludes these from public search results by default, requiring email verification before showing them. This is a deliberate privacy protection — it means someone else searching your email address publicly won't see these specific breaches, only you will after verifying you own that address.

Checking Family Members' Accounts

If you manage devices or accounts for less tech-confident family members (parents, children with their own email accounts), consider periodically checking their addresses too, with their knowledge and permission — breach fallout (reused passwords, resulting phishing attempts) often hits the least security-aware members of a household hardest, since they're less likely to notice or respond to the warning signs.

Checking your email against known breaches takes under a minute and costs nothing, yet many people never do it and remain unaware their password has been circulating publicly for months or years. Making it a routine check — and acting properly on what it finds — closes off one of the most common paths attackers use to compromise accounts.

Was this guide helpful? Explore more Privacy Settings guides, or browse all Security & Performance articles.