Password Found in a Data Breach? What to Do Next

🧯Free Password Breach Checker
Has your password appeared in a data breach? Checked privately.Open tool →

1. Change it everywhere it's used

Start with your email account (it can reset everything else), then banking, payment apps, work accounts and social media. Every site needs a different new password.

Use the Password Generator to create strong, unique ones.

2. Turn on two-factor authentication

2FA stops most account takeovers even when a password leaks. Prefer an authenticator app or passkeys over SMS codes.

3. Check for signs of misuse

Look at recent sign-ins and security alerts in your email and key accounts, check for unfamiliar forwarding rules in your mailbox, and watch bank statements for small test charges.

4. Stop reusing passwords

A password manager (Bitwarden, 1Password, the one built into your browser or phone) remembers unique passwords so you don't have to. Reuse is the only reason one breach becomes many.

Frequently asked questions

How do you check if my password leaked without seeing it?

Your browser sends only the first 5 characters of its SHA-1 hash; the comparison happens on your device.

My password wasn't found – am I safe?

Not necessarily. It may be weak or leaked somewhere not yet public. Use unique passwords and 2FA anyway.

Should I change all my passwords?

Prioritise accounts that shared the leaked password, then important accounts.