Check your email address in Have I Been Pwned (HIBP) to see whether it appears in a breach record, then check each password separately with HIBP’s Pwned Passwords service. These are different checks: an email appearing in a breach does not prove your current password was exposed. If a password matches, stop using it and replace it everywhere you used it, including accounts with slightly modified versions. Secure your email account promptly, since an inbox can be used to reset access to other services.
Check your email address and passwords separately
Look up your email address
Use the breach-search feature in the Have I Been Pwned dashboard to see whether HIBP has indexed a breach record containing your email address. The dashboard also offers searches for sensitive breaches and stealer-log entries after email verification. An alert means the address appeared in data HIBP has indexed; it does not, by itself, show that someone has taken over an account or that your current password was included.
As an Amazon Associate I earn from qualifying purchases.
Check a password with Pwned Passwords
Open HIBP’s Pwned Passwords feature and check the password you want to assess. HIBP says the page hashes the password in your browser, sends the first five characters of its SHA-1 hash, receives matching hash suffixes, and compares the complete hash locally. That is the service’s lookup design, not a guarantee against every risk from every website, device, or tool. Do not paste a password into an unfamiliar third-party checker.
Recommended Free Tools
A match means the password is in the service’s known corpus; do not keep using it. A no-match means only that the service did not find it in the data it has loaded. It does not prove the password is strong, has never been exposed, or is absent from every breach dataset.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do when a password or account is exposed
Replace the password wherever it was used
Change the password on the affected service and on every other account where you reused it or used a close variation. Give each account a different password; changing only a few characters from the old one is not a safe substitute for a unique credential. Prioritize your email account and financial accounts because access to email can help someone reset passwords elsewhere.
Check account access and recovery settings
If you suspect someone accessed an account, follow the provider’s security settings to sign out of other sessions, then enable multi-factor authentication (MFA). Confirm the recovery email addresses and phone numbers are yours. In an email account, inspect forwarding rules, sent mail, and deleted mail for activity or changes you did not make. If you are locked out, use the provider’s account-recovery process; once access is restored, complete these checks.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Make future passwords harder to reuse or guess
Use a password manager or a browser’s password-saving and generation feature to create and store unique passwords. Guidance differs on a specific minimum length: the FTC’s October 2024 alert recommends aiming for 12 to 15 characters, while CISA’s 2024 Secure Our World password tip sheet specifies 16 characters. Both support the practical priorities of long, unique passwords and using a manager. The FTC also describes a random-word passphrase as an option and warns against familiar phrases.
Choose MFA based on protection and recovery
Enable MFA on email, financial, social, tax, and payment accounts. When the service supports them, prefer a security key or authenticator app over text-message or email codes. The FTC characterizes a security key as the strongest 2FA method in its guidance, but you must check that the account and your devices support it and plan how to recover access if the key is lost. An authenticator app is a practical alternative where keys are unsupported. Text and email codes are weaker fallback choices; a SIM-swap can expose text-message codes.
Before relying on any MFA method, consider whether the service supports it, how vulnerable it is to phishing or phone-number takeover, how convenient it is for daily use, and how you will recover the account if a device or key is lost. Store recovery codes safely and configure backup factors using the service’s own instructions; there is no single enrollment sequence that applies to every provider.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Sources and guidance
- HIBP Pwned Passwords explains the password lookup and its limitations.
- HIBP dashboard provides breach-search features for email addresses.
- The FTC’s October 2024 account-security alert and FTC personal-information guidance cover password practices and account protection.
- CISA’s 2024 Secure Our World password tip sheet gives its 16-character recommendation.
- The FTC explains two-factor authentication options, including the security trade-offs of text codes and security keys.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
