If a password was exposed, change it promptly—and change it anywhere you reused it or a similar version. Secure the email account used for password resets. If you may have lost control of an account, recover it through the provider’s official process, then check for unauthorized changes and enable multi-factor authentication (MFA). If financial or government identity information may have been misused, contact the affected institution and use IdentityTheft.gov for reporting and recovery guidance.
First, work out whether this is exposure or an account takeover
A breach notice saying a password was exposed does not by itself prove that anyone signed in to your account. Treat the password as compromised anyway: replace it and any reused or similar versions. Signs of a possible takeover include being locked out, unfamiliar sign-ins or password changes, recovery details you did not change, or messages sent from your account without permission. The Federal Trade Commission’s account-hijacking guidance describes these as warning signs.
As an Amazon Associate I earn from qualifying purchases.
Use the affected service’s official website or app—not a link in an unexpected email or text—to check the account or begin recovery. If the notice itself seems suspicious, go to the service directly using a saved bookmark or typed address.
Recommended Free Tools
Secure the email account that can reset your other passwords
Prioritize the inbox used for password resets. Someone who controls that inbox may be able to receive reset messages and take over other accounts. If its password was exposed, replace it with a unique one. Review recent activity and signed-in devices, confirm that recovery email addresses and phone numbers are yours, and turn on MFA.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
After securing email, prioritize accounts with high consequences if compromised: banking and payment services, tax accounts, social accounts, and other services that store sensitive personal information.
Change the exposed password everywhere it was reused
- Open the service’s official app or website and change the password for the affected account.
- Change it on every other service where you used the same password or a similar version. Do not rely on changing only a few characters.
- Give each account a distinct password. A password manager can help generate and keep track of unique credentials; a browser’s built-in password storage is another option described by the FTC.
Password-length guidance differs by organization. In an October 2024 consumer alert, the FTC said to “Aim for 12 to 15 characters” and suggested a passphrase as an alternative. CISA’s 2024 tip sheet recommends passwords that are “16 characters long, random and unique for each account.” These are the respective organizations’ recommendations, not one universal minimum. See the FTC alert and CISA password guidance.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
If you are locked out, recover the account and check what changed
Use the provider’s official recovery instructions if you cannot sign in. Once access is restored, do more than set a new password: look for changes that could let someone back in or continue receiving information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Review recent security events, sign-ins, and devices; sign out devices or sessions you do not recognize.
- Confirm that recovery phone numbers and email addresses are yours.
- Check connected accounts and apps, and remove anything you do not recognize.
- For email, inspect forwarding rules and automatic replies, where those settings exist.
- If messages may have been sent from your account, tell affected contacts to disregard suspicious requests or links.
Google advises reviewing recent security events and devices in its account security guidance. Microsoft’s compromised-account guidance includes checking connected accounts, forwarding, and automatic replies.
Turn on MFA and choose a method you can recover
MFA adds a second sign-in check beyond the password. Enable it wherever available, starting with email and financial accounts. The FTC says security keys are the strongest method among the common options it discusses, and recommends an authenticator app or security key over text or email codes when available. Services vary in what they support.
- Security key: A physical key used as a sign-in factor. It can provide strong protection, but check that the service and your devices support it and plan what you will do if the key is lost.
- Authenticator app: Generates sign-in codes and is preferable to text or email codes when supported, according to FTC guidance.
- Text or email code: Often more widely available, but less secure than the stronger methods described by the FTC.
- Passkey: Where supported, passkeys can reduce phishing risk. Google says, “Passkeys can’t be shared, copied, written down, or accidentally given to someone else.” Availability and setup depend on the service and device.
Consider phishing resistance, support across your devices, ease of use, and the recovery process before choosing a method. Keep recovery details current, and store backup codes safely if the service provides them. MFA and a password manager solve different problems: MFA adds a sign-in factor, while a password manager helps you maintain distinct passwords. See FTC guidance on protecting online accounts and Google’s passkey information.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Respond to suspected malware or device compromise
A leaked password alone does not establish that your computer or phone has malware. If suspicious account activity suggests the device may also be compromised, follow the provider’s device-security advice. Microsoft recommends making sure antivirus software is running and up to date, then performing a full scan; Google also advises removing harmful software when relevant. These recommendations support a targeted scan when malware is suspected, not buying or installing a separate scanner for every password leak.
Act promptly if personal or financial information may have been misused
If payment details, bank credentials, tax information, a Social Security number, or government identity information may have been exposed or misused, contact the relevant bank or institution promptly. The appropriate response depends on what information was involved and whether misuse has occurred. The FTC directs people whose personal information is being used to IdentityTheft.gov, which provides reporting resources and a personalized recovery plan. Its identity-theft guidance explains additional steps.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
