How to Check If Your Password Has Been Hacked
Billions of passwords have leaked in data breaches, and most people never find out that theirs were among them. The good news: you can check in a couple of minutes, safely, without handing your password to anyone.
1. Check the password itself (safely)
Use the password breach checker. It never sends your password anywhere. Your browser turns it into a SHA-1 hash, sends only the first five characters of that hash to Have I Been Pwned, and compares the results locally. This method is called k-anonymity.
- Found in breaches: treat the password as public. Change it everywhere you used it.
- Not found: good, but it doesn’t prove the password is strong. Check it with the strength checker too.
Be careful with other websites that ask you to type a password “to check if it’s hacked”. If a site doesn’t explain that it uses a privacy-preserving method like this, don’t use it.
2. Check your email address
Search your email at haveibeenpwned.com. It lists the breaches your address appeared in and what was exposed: passwords, phone numbers, addresses or more. You can also sign up there for free alerts about future breaches. Many password managers and browsers (for example Google Password Manager’s Password Checkup) also warn you about leaked saved passwords.
3. Look for signs your account is already compromised
- “New sign-in” or “password changed” emails you didn’t trigger.
- Sent messages, posts or orders you didn’t make.
- Unknown devices or locations in your account’s security page.
- Your recovery email or phone number has been changed.
- Friends receiving strange messages or payment requests from you.
- Unexpected OTPs arriving by SMS: someone may be trying to log in or reset your password.
4. If your password was exposed: what to do
- Change it on the affected account, and on every other account that used the same or a similar password. Create new ones with the password generator.
- Secure your email first, because it can reset everything else.
- Sign out all other sessions from the account’s security settings.
- Turn on two-factor authentication. See our 2FA guide.
- Review recovery details and remove anything you don’t recognise.
For a fuller checklist, including what to do if card or ID details leaked, read what to do after a data breach.
5. Make the next breach harmless
You can’t stop companies being breached, but you can make sure a breach only affects one account. Use a unique password for every site, store them in a password manager, and enable 2FA on important accounts. Then a leaked password from one site becomes a minor inconvenience instead of a disaster.