Recommended Free Tools
Check the email address or username you use for accounts with a reputable breach lookup, then check passwords separately. A match means the service found that information in the breach records it has loaded; it does not prove that anyone currently controls your account. No match is not a guarantee that your information was never exposed.
Check an email address or username for known breach records
- Open Have I Been Pwned’s FAQ and use its public search for the email address or username you use with online accounts.
- Search one identifier at a time. The service checks it against breach data it has loaded; it is not a scan of every website or database on the internet.
- If there is a match, review the breach context shown and use it to identify which service or account to secure. A result alone does not show every detail exposed or establish that the information has been used.
A result with no match means the identifier was not found in the records available to that service. It cannot rule out exposure in records the service does not have.
As an Amazon Associate I earn from qualifying purchases.
Check passwords separately
An email lookup and a password check answer different questions. Have I Been Pwned’s Pwned Passwords feature checks whether an individual password has appeared in breach data; its FAQ says it does not pair that password with personal identifiers. Google’s Password Checkup can check passwords saved in a Google Account and notify users when saved passwords may have been compromised. Google recommends going directly to Password Checkup to verify a notification and change unsafe passwords.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not enter a password into an unfamiliar site or share it with anyone. A password-checking result does not replace an email-address lookup or an investigation of account activity.
#1 Best Overall
What to do when a check or breach notice finds a problem
If an email address or username appears
Use the result as a prompt to inspect the relevant service and secure the account. The match alone is not evidence that someone has logged in. If the service that suffered the breach has notified you, follow its instructions and use its official website or app rather than links in an unexpected message.
If a password appears in breach data or a breach notice
Treat that password as unsafe. The FTC advises: “If a company tells you about a breach — especially one involving your password — immediately change the password you use with that company and on your accounts using a similar password.” Replace every reused version with a unique password. The FTC recommends considering a password manager to create and keep track of unique passwords.
If an account shows signs of takeover
Use the service’s official recovery process. After regaining access, follow the FTC’s account-recovery guidance:
- Change the account password and sign out of other devices or sessions.
- Enable two-factor authentication where available, and verify recovery email addresses and phone numbers.
- Check for unfamiliar activity and email-forwarding rules you did not create.
The FTC says an authenticator app or security key is a more secure type of two-factor authentication. A security key is an optional account-protection measure, not a way to detect exposure; check that the service supports it.
If a Social Security number or financial information was exposed
Follow the FTC’s data-breach response guidance. If your Social Security number was exposed, obtain your credit reports and look for accounts you do not recognize. Check whether the breached organization offers free credit monitoring or identity-theft services. If identity theft has occurred, IdentityTheft.gov provides a guided report and recovery plan.
Handle unexpected “dark web” alerts cautiously
An unsolicited email or message claiming that your information is for sale may be a scam. The FTC’s guidance on dark-web alerts is to avoid clicking links or calling numbers in an unexpected message. If it might be legitimate, contact the company using a website or phone number you already know is real.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What these checks establish—and what they do not
| Check | What it checks | What a result tells you | What it does not establish |
|---|---|---|---|
| Have I Been Pwned public search | One user-provided email address or username against breach data the service has loaded, as described in its FAQ. | Whether that identifier appears in the available breach records. | Whether an account is currently controlled by someone else, whether all exposed details are shown, or whether the identifier appears in records not loaded by the service. |
| Have I Been Pwned Pwned Passwords | An individual password against breach data; the service says it does not pair the password with personal identifiers in its FAQ. | Whether the password has appeared in the data it checks. | Whether a particular account is compromised or whether an email address appears in breach records. |
| Google Password Checkup | Passwords saved in a Google Account, according to Google’s help page. | Whether Google flags a saved password as potentially compromised. | Whether other passwords or personal information outside that saved-password scope were exposed. |
None of these is a universal scan of the internet. A positive result is a signal to take the appropriate account or identity-protection steps; a clean result cannot establish that all personal information is safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
