Free tools Windows power users keep installed
One-click scans. No signup required.
Check an email address with Have I Been Pwned or Mozilla Monitor. Check passwords saved to a Google Account with Google Password Checkup, or check an individual password with HIBP Pwned Passwords. A match means the address or password appears in the service’s collected breach data; it does not prove someone currently has access to an account. A clean result is not proof that nothing was exposed.
What an email check tells you—and what it does not
An email lookup searches known breach records for an address. It does not test whether the mailbox itself is currently secure or whether someone is signed in to one of your accounts. Results can include the breach name, date, and categories of data reported as exposed; treat them as evidence of a recorded past incident, not proof of present-day misuse.
As an Amazon Associate I earn from qualifying purchases.
Start with Have I Been Pwned’s email search. You can also use Mozilla Monitor, which checks email addresses against known breaches using HIBP data and provides monitoring and recovery guidance. Mozilla’s setup flow describes signing in, opening the dashboard, and adding an address via an email verification link. The service’s address limits and other product terms can change, so check its current interface rather than relying on an old limit.
Some breach records are treated as sensitive and are not publicly searchable. HIBP says an address owner must verify access through its dashboard to see sensitive breaches; Mozilla also says sensitive-site exposure requires sign-in or subscription and email verification. See the HIBP dashboard and Mozilla Monitor FAQ.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If an address is not found, that only means the service did not find it in the breach data it has indexed. An incident may be missing from that data, so a clean result cannot establish that the address or its accounts were never exposed.
How to check a password safely
Password checks answer a different question from email searches. They look for the password itself in known exposed-password data; they do not identify the person or account that used it. HIBP says its password hashes are stored separately from email breach records and are not linked to addresses. That means you cannot use its password checker to discover whose password it was—or use an email result to infer which password was exposed. HIBP explains its data classes here.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Check passwords saved to Google
Open Password Checkup through Google Password Manager on the web, in Chrome, or on Android. Google says it can flag exposed, weak, and reused passwords saved to the Google Account. Its scope is those saved credentials; passwords stored elsewhere or never saved to that account may not be included. See Google’s Password Checkup instructions.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check one password with HIBP
For an individual password, use HIBP Pwned Passwords, not an unfamiliar site that asks you to submit an active password. HIBP says the checker hashes the password on your device, sends only the first five characters of its SHA-1 hash, and receives possible matching suffixes; the full comparison is performed locally. The full password and full hash are not sent using this method.
A match is a reason not to use that password. If you have used it on an account, replace it there and on any other account where it was reused. A password not found in HIBP’s data is not thereby proven strong or safe; it simply was not found in the indexed password corpus.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What built-in breach alerts cover
Existing browser and account tools can help, but each has a defined scope. Google Password Checkup covers credentials saved to the relevant Google Account, not every password you may use. Firefox also documents breach alerts for known breaches affecting websites a user visits. Mozilla says rollout began gradually with Firefox version 152 and may not yet be available to everyone; check the current Firefox breach-alert guidance for availability. These alerts complement direct email and password checks rather than replacing them.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Which check should you use?
| Tool | What it checks | Scope and important limit |
|---|---|---|
| Have I Been Pwned email search | Whether an email address appears in indexed breach records | Sensitive breaches require verified access; a clean result does not prove there was no exposure. |
| Mozilla Monitor | Email exposure using HIBP breach data, with monitoring and recovery guidance | Email verification is part of setup; sensitive-breach access has additional controls. |
| HIBP Pwned Passwords | Whether an individual password appears in known breached-password data | Uses a hash-prefix privacy method; it does not associate a password with an email address. |
| Google Password Checkup | Exposure, weakness, and reuse among passwords saved in a Google Account | Checks saved credentials in that account, not passwords stored elsewhere or never saved there. |
| Firefox breach alerts | Known breach signals about sites visited in Firefox | Availability is still described as a gradual rollout; it is not a complete account-level check. |
What to do if a check finds a match
- Go to the affected service directly. Open its official website or app yourself instead of following a sign-in link in an unexpected breach or security email. Fraudulent messages can imitate breach notifications. AP’s consumer guidance also advises caution around suspicious security messages.
- Change the affected password and any reused copies. Make each replacement unique. Mozilla recommends changing an exposed password on the affected service and anywhere the same password was used; see its breach-resolution guidance.
- Review account activity and recovery information. Check recent sign-ins, sign out unfamiliar sessions, verify recovery details, and remove unrecognized devices or connected services where the account offers those controls. Mozilla provides account activity and protection guidance.
- Enable multifactor authentication. Turn on two-step verification or another supported second factor. Depending on the service, that may be an authenticator app or a hardware security key; a key only works for accounts that support it. See Mozilla’s account guidance and AP’s consumer guidance.
- Use a password manager if it helps. It can generate and store distinct passwords so you do not have to reuse one. It helps with the response, but it does not tell you whether an address appeared in a breach.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
