Everyday Digital Explained

How Do I Check if My Password Has Been Leaked? (Free Tools)

Last verified against 14 official sources

Short answer: Use a free checker. At haveibeenpwned.com, type your email address to see which known data breaches included it, and use its Pwned Passwords tool to check a password without sending the full password. If you save passwords with Google, run Password Checkup at passwords.google.com; on an iPhone with iOS 18 or later, open the Passwords app and tap Security. Change any password flagged as leaked everywhere you used it, then turn on a passkey or two-step verification.

Watch the video: How Do I Check if My Password Has Been Leaked? (Free Tools)▶ Watch the short video
  • Stick to the checkers named here. Be careful about typing your passwords into an unfamiliar "password checker" website.
  • Never change a password through a link in an email or text that says your password leaked. Go to the site or app yourself.
  • Only create passkeys on devices you own, not on a shared or public computer.

Step by step

  1. Check your email address. Go to haveibeenpwned.com, type your email address, and select Check. It shows known data breaches that included that address. You can also sign up for its Notify Me alerts about future breaches.
  2. Check a password privately. On haveibeenpwned.com/Passwords, your password is turned into a scrambled code (a hash) on your own device, and only the first 5 characters of that code are sent. If the result says the password was found in a breach, stop using it.
  3. Run Google Password Checkup. Go to passwords.google.com, select Go to Password Checkup, then Check passwords. In Chrome on a computer, you can also open the three-dot menu, then Passwords and autofill, Google Password Manager, and Checkup. It flags saved passwords that are exposed, weak, or reused.
  4. Check your iPhone's Passwords app. On iOS 18 or later, open the Passwords app and tap Security to see weak or compromised passwords. Make sure Settings > Apps > Passwords > Detect Compromised Passwords is turned on. On iOS 17 or earlier, go to Settings > Passwords > Security Recommendations.
  5. Change leaked passwords, starting with email. Change each flagged password on the real website or app, starting with your email and money accounts. If you used that password anywhere else, change it there too. Use a different password for every account; a password manager can create and remember them for you.
  6. Turn on a passkey or two-step verification. A passkey lets you sign in with your fingerprint, face, or screen lock, and Google says it can't be shared, copied, or accidentally given away like a password. Where passkeys aren't offered, turn on two-step verification. The FTC says an authenticator app or security key is safer than codes sent by text or email.

How these checkers keep your password private

Have I Been Pwned's Pwned Passwords tool uses a method called k-anonymity. Your password is hashed (turned into a scrambled code) on your device, and only the first 5 characters of that code go to the service. The service sends back every leaked password code that starts the same way, and your device does the final match. Have I Been Pwned says it never receives your full password or its complete hash, and that Pwned Passwords is free.

Apple's Password Monitoring works in a similar way. Apple says it uses a form of cryptographic private set intersection, and for each password it sees only a short piece (a 15-bit prefix) of a cryptographic hash. Google Password Checkup checks the passwords you've saved in Google Password Manager.

If you can't log in or think someone got in

If you can't log in, contact the company and ask how to recover the account or shut it down, using a phone number or website you know is real. IdentityTheft.gov also says to check financial accounts for charges you don't recognize or changes like a new mailing address.

Be careful with emails or texts saying your password was leaked. Go to the website or app yourself to change your password, instead of using a link in the message.

Common questions

Is Have I Been Pwned safe and free to use?

Have I Been Pwned says it's meant to be a free service for people to check their risk, and its Pwned Passwords tool is free and open source. When you check a password, only the first 5 characters of its hash leave your device. Some very sensitive breaches are only shown to the verified owner of the email address.

My email showed up in a data breach. Does that mean I've been hacked?

It means your email address was in data exposed by that site's breach. It doesn't by itself mean someone got into your email account. Change your password for that site, and anywhere else you used the same password, and turn on two-step verification.

Do I have to check my passwords one at a time?

No. Google Password Checkup checks all the passwords saved in Google Password Manager, and the iPhone Passwords app watches your saved passwords and lists problems under Security. Have I Been Pwned's password tool checks one password at a time.

What's the difference between a passkey and two-step verification?

A passkey replaces your password: you sign in by unlocking your device with a fingerprint, face scan, or screen lock PIN, and Apple says passkeys resist phishing. Two-step verification adds a second check after your password, such as a prompt on your phone, a code from an app, or a security key. Both make a leaked password much less useful to a scammer.

Which devices can use a passkey for a Google Account?

Google lists computers with Windows 10, macOS Ventura, or ChromeOS 109 or later, and phones with Android 9 or iOS 16 or later. A hardware security key that supports FIDO2 also works. Google says to create passkeys only on devices you own.

Official sources

Related