Security tips / Account Security

How to Check If Your Password Has Leaked Online (and What to Do in the Next 10 Minutes)

PPosted by PeregrinoTech · October 26, 2026 · 5 min read

Every few weeks another company announces a breach and a few million more email-and-password pairs join the pile already circulating online. Criminals take those pairs and try them everywhere, because most people reuse passwords. It is called credential stuffing and it is the number one way accounts get taken over.

The question is not whether one of your old passwords is out there. It almost certainly is. The question is whether you are still using it.

Before you start

• Never type your current password into a random “check my password” website. The tools below are safe because they never see the full password. Anything else is a phishing risk.
• Do this from your own computer, not a shared or public one.

Method 1: Check your email address at Have I Been Pwned

Have I Been Pwned (HIBP) is run by security researcher Troy Hunt and is the reference database of known breaches. Enter your email address and it lists every breach that included it, what data leaked, and when.

1. Go to haveibeenpwned.com.
2. Type your email address and press Check.
3. Read the list. For each breach, note whether passwords were included.
4. Click Notify me at the top to get an email the next time your address appears in a new breach. This is free and worth doing for every address you own.

What a result means: if a breach included passwords and you have not changed that site’s password since the breach date, change it now. If you used the same password anywhere else, change those too.

Method 2: Check a specific password, safely

HIBP also has a password search. It uses a technique called k-anonymity: your browser hashes the password, sends only the first five characters of the hash, and gets back a list of matching hashes to compare locally. The full password never leaves your machine.

Go to haveibeenpwned.com/Passwords, type a password, and it tells you how many times it has appeared in breaches. If the number is anything other than zero, that password is on criminals’ lists.

The same check from PowerShell

For the technically inclined, here is the identical check from a PowerShell window. It sends only the five-character prefix, exactly as the website does.

$pw = Read-Host "Password to check" -AsSecureString
$plain = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($pw))
$sha1 = [BitConverter]::ToString([Security.Cryptography.SHA1]::Create().ComputeHash([Text.Encoding]::UTF8.GetBytes($plain))).Replace("-","")
$prefix, $suffix = $sha1.Substring(0,5), $sha1.Substring(5)
$hits = (Invoke-RestMethod "https://api.pwnedpasswords.com/range/$prefix") -split "`r?`n" | Where-Object { $_ -like "$suffix*" }
if ($hits) { "LEAKED: seen $(($hits -split ':')[1]) times. Change it." } else { "Not found in known breaches." }
$plain = $null

Method 3: Let your password manager do it continuously

The best tools check every password you have, all the time.

Tool	Where to find the check
Bitwarden	Reports → Exposed Passwords, Reused Passwords, Weak Passwords
1Password	Watchtower
Google Password Manager	passwords.google.com → Checkup
Apple Keychain	Settings → Passwords → Security Recommendations
Microsoft Edge	Settings → Passwords → Password Monitor

If you are not using a password manager yet, this feature alone is reason to start. See Passwords and 2FA: the 20-minute upgrade.

Found a match? Do this in the next 10 minutes

1. Change the password on the breached site. Make it long and unique. Let the password manager generate it.
2. Change it everywhere else you used it. This is the step people skip, and it is the one that matters. Credential stuffing works because of reuse.
3. Turn on two-factor authentication on the affected accounts, using an authenticator app rather than text message where possible.
4. Check for damage. Look at recent logins, sent emails, forwarding rules, linked devices and recent transactions.
5. If it was your main email, treat it as an emergency: that account resets every other one. Change it first, enable 2FA, and review recovery options for anything the attacker might have added.
6. Sign out of all sessions. Most services have a “sign out everywhere” button under security settings. Use it.

What makes a password safe now

The old advice (eight characters, a capital, a number, a symbol) produced passwords like Summer2024! that crack in seconds. Modern guidance, including NIST’s, is simpler:

• Length beats complexity. 16 or more characters. A passphrase of four or five random words is excellent.
• Unique per site. No exceptions. That is what the password manager is for.
• Never on the leaked list. Which is what this post is about.
• Do not rotate on a schedule. Change a password when there is a reason to, not every 90 days. Forced rotation produces Summer2024! followed by Autumn2024!.

Common mistakes

• Checking once and moving on. Breaches are continuous. Subscribe to HIBP notifications and use a password manager with monitoring.
• “Changing” a password by adding a number. Criminals’ tools try those variations automatically.
• Pasting your password into an unknown checker. You have just given it away. Use HIBP, your password manager, or the k-anonymity script above.
• Ignoring old accounts. That forum from 2012 with your reused password is exactly where the leak came from. Change it or delete the account.

FAQ

Is Have I Been Pwned safe to use?

Yes. It is widely used by governments and companies, the email search tells you about breaches rather than storing anything new, and the password search never receives your full password.

My email shows up in 15 breaches. Should I panic?

No. It means your address is public, which it is for almost everyone. Focus on the breaches that included passwords and on whether those passwords are still in use anywhere.

Should I change my email address?

Usually not. Change the passwords, enable 2FA, and subscribe to alerts. A new address only helps until it leaks too.

Final thoughts

Five minutes on Have I Been Pwned will tell you more about your real exposure than any amount of worrying. Check your addresses, fix what you find, put a password manager in charge, and let it watch for the next breach so you do not have to.

Useful resources

• Have I Been Pwned
• NIST SP 800-63B: Digital Identity Guidelines (password section)
• Bitwarden (free, open source password manager)

Know the attack. Own the defense.

Tagged:PasswordsData breaches2FAPowerShell