Use two separate checks: search your email address in a breach lookup, then check any password you may have reused in an exposed-password lookup. A match means the information appears in data the service has indexed; it does not by itself prove that anyone currently has access to your account. If a password is exposed, stop using it and replace it anywhere it was used.
Check whether your email address appears in a known breach
- Go directly to Have I Been Pwned by typing the address or opening a bookmark. Avoid links in unexpected breach-warning messages.
- Enter your email address in the email-address lookup and review the result. If it lists breaches, check the incident names and the types of information associated with each one.
A match means the address appears in data included in the service’s database. It is an exposure signal, not proof that the mailbox was accessed or that an account is currently under someone else’s control. The listed data types describe what is associated with a known incident; they do not identify a current attacker or establish present-day access.
As an Amazon Associate I earn from qualifying purchases.
A no-match means the service did not find the address in the breach data it has loaded. It cannot prove that the address has never been exposed, because a lookup can only cover data the service has obtained and indexed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Check passwords separately
An email-address result does not tell you which password was involved. Use the separate Pwned Passwords lookup to check a password, or use a reputable password manager’s security-check feature. Never send a password to a person or enter it into an unrelated form or breach-warning link. If privacy handling matters to you, consult the lookup service’s current privacy documentation; do not assume every service handles searches in the same way.
#1 Best Overall
A password match means that password appears in known exposed-password data. It does not show which of your accounts used it, or prove that a particular account is currently compromised. Treat it as a reason to stop using that password, especially if you have reused it.
| Check | What you search | What a match tells you | What to do next |
|---|---|---|---|
| Email breach lookup | An email address | The address appears in breach data loaded by the service; this is not proof of current account access. | Review the incident and exposed data types, then secure affected accounts. |
| Exposed-password lookup | An individual password | The password appears in known exposed-password data; it does not identify a currently compromised account. | Replace it everywhere you used it. |
What to do if a password was exposed
- Change it on the affected service. Go to that service through its official website or app and choose a new, unique password.
- Replace reused passwords elsewhere. Change the same or a similar password on every other account where you used it. Give priority to important accounts, especially the email account used to reset other passwords. The FTC’s account-recovery guidance also recommends changing the password.
- Sign out other devices and sessions. Use the service’s account-security settings to end sessions you do not recognize or no longer need.
- Turn on two-factor authentication. Enable it wherever the service offers it. CISA explains that multifactor authentication adds a layer of defense if a password is compromised; it reduces risk but is not a guarantee against unauthorized access. CISA’s guidance is archived and describes the general security principle.
- Check recovery and email settings. Confirm that the recovery email address and phone number are yours. In your email settings, remove any forwarding rules you did not create.
A password manager is optional. It can generate and store a different strong password for each account, but you do not need one to perform either lookup or to change exposed credentials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you can no longer sign in
If someone changed your password or recovery details, use the affected provider’s official account-recovery process. Do not rely on contact links in an unexpected message. Once access is restored, follow the FTC’s guidance to change the password, sign out other devices, enable two-factor authentication, verify recovery information, and inspect email forwarding rules. See the FTC’s steps for responding to a hacked email or social media account.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
