If a password has leaked but you can still access the account, change it to a new, unique password in the service’s official app or website, then use its security settings to review and sign out other sessions. Those are separate actions: changing a password does not necessarily end every existing session. If you are locked out, start with the provider’s official account-recovery process.
If you can still sign in, secure the account in this order
- Open the official service. Use its app or type its known website address yourself. Avoid unexpected password-reset links in messages.
- Change the password. Choose a strong password you have not used on another account. The Federal Trade Commission recommends aiming for 12 to 15 characters or using a passphrase; exact requirements vary by service. FTC guidance (October 2024).
- Revoke sessions you do not recognize. In the account’s security settings, find devices, recent activity, or session controls. Sign out unfamiliar sessions. If there is a “sign out everywhere” option and you need to revoke other sessions, use it after checking its scope and timing.
- Turn on two-factor authentication. Enable it if the service offers it. It adds a verification step beyond the password. FTC guidance.
- Check account recovery and connected settings. Confirm recovery email addresses and phone numbers belong to you and are accessible. Review linked apps and other account settings for changes you did not make.
- Replace any reused password elsewhere. Change it on every other account where you used it. Prioritize your email account, which may receive password-reset messages, and accounts that use the affected account for sign-in or recovery. Google’s compromised-account guidance.
Changing a password is not the same as signing out devices
A password change protects future sign-ins, but services handle existing sessions differently. A browser or app may remain signed in until you revoke that session, while an account-wide sign-out may take time or exclude some devices. Look for device or session controls in the provider’s security area, and read the service’s explanation of what the control covers before relying on it.
As an Amazon Associate I earn from qualifying purchases.
Google Account: check each device and its sessions
Google’s device page lists devices where you are signed in or were signed in recently and lets you sign out from a device or session. One device can have multiple sessions—for example, separate browser, app, or service sign-ins. If you need to ensure that access from a particular device is ended, Google says to sign out all sessions listed under that device name.
A recent activity time can reflect background communication. A timestamp later than your last manual use does not, by itself, prove someone else accessed the account. Review the device and activity details alongside other signs, such as unfamiliar security events or changed recovery information.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft account: account-wide sign-out can take time
Microsoft says its “sign out everywhere” action can take up to 24 hours to sign you out of browsers, apps, and other places your account is used, and it excludes Xbox consoles. Do not assume every Microsoft-connected session ends immediately. Microsoft also lists physical security keys as a passwordless sign-in option; a key is optional follow-up protection, not a substitute for changing a leaked password or ending active sessions.
If you cannot sign in
Go directly to the affected provider’s official recovery page and follow its instructions. The FTC recommends using the provider’s recovery process when you cannot access a hacked email or social account. After access is restored, change the password, review recovery details and account activity, and notify contacts if the account may have sent messages they could mistake for yours. FTC guidance.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
If you suspect malware on your device
Device-scanning advice depends on the service and the nature of the suspected compromise; a scan is not a universal prerequisite whenever a password leaks. For a compromised Microsoft account, Microsoft specifically advises running an up-to-date antivirus full scan before changing or resetting the account password. After regaining control, it also advises checking connected accounts, email forwarding, and automatic replies. Follow the provider’s instructions for the account involved. Microsoft’s compromised-account guidance.
What to check after you regain control
- Recent sign-ins, security events, and devices you do not recognize.
- Recovery email addresses and phone numbers, plus linked apps or services.
- Account settings that could hide or redirect activity. For email, inspect forwarding and automatic replies.
- Other accounts where the leaked password was reused or where this account is used for sign-in or recovery.
- Two-factor authentication options. Google’s Password Checkup can identify exposed, weak, or reused passwords in your Google Account; see Google Password Checkup.
These provider examples are not universal instructions for every bank, social platform, employer account, or identity provider. Menus, session controls, recovery processes, and revocation timing vary; use the official help pages for the service you need to secure.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
