How to Check if Your Passwords Have Been Leaked Online

When a website is breached, stolen passwords often end up in lists that criminals share and use to break into other accounts. You can check whether yours are among them, safely, without typing your password into a stranger's website.

1. Use your browser's built-in check

• Chrome: Google Password Manager → Checkup flags compromised, reused and weak passwords. See auditing Chrome's saved passwords.
• Edge: Password Monitor, in Settings → Passwords.
• Safari and iPhone: the Passwords app shows security recommendations for leaked passwords.
• Firefox: the password manager warns about passwords from known breaches.

2. Use your password manager

1Password, Bitwarden and other password managers have reports that check saved passwords against breach lists.

3. Check your email address

Have I Been Pwned lets you search an email address to see which known breaches include it. If a breach included passwords, change that password and any password like it.

How the checks stay safe

Good checkers never see your actual password. Have I Been Pwned's Pwned Passwords service, used by many tools, receives only the first five characters of a scrambled version (a hash) of your password, and sends back a list of matches for your device to compare. Browsers use similar methods.

Don't type your password into random "is my password leaked?" sites. A fake checker is an easy way to steal it.

If a password was leaked

1. Change it on that site right away.
2. Change it everywhere else you used it, since criminals try leaked passwords on other sites.
3. Turn on two-factor authentication. See setting up two-factor authentication.
4. Check recent activity for logins, purchases or changed settings you don't recognize.
5. Start with your email account, since it can reset all your other passwords.

Stay ahead of the next breach

• Use a different password for every site; a password manager makes that practical.
• Switch to passkeys where sites offer them.
• Recheck every few months, and whenever a breach is in the news.
• Treat breach emails with care: real ones tell you to change your password on the site itself, while fake ones push you to click a link and sign in.

See checking if your email was in a breach. If you copy and paste passwords, Clipboard Guard stops websites from reading your clipboard.