Free tools Windows power users keep installed
One-click scans. No signup required.
Act quickly, but do not panic. Verify the warning through the account provider’s own website or app, change the exposed password to a new password used nowhere else, change it anywhere you reused or closely copied it, and turn on multifactor authentication (MFA). Then review active sessions, recovery details, account activity and suspicious settings. If you are locked out, use only the provider’s official recovery process.
An exposed password does not prove that every account or device you use has been taken over. It does mean the password should no longer be trusted. The steps below separate a password warning from signs of an account takeover, and explain when device malware precautions are appropriate.
As an Amazon Associate I earn from qualifying purchases.
What “exposed” and “reused” mean
A password is exposed when someone else may have obtained it—for example, after a service breach, a phishing attempt, or an unsafe password stored in a browser. A service may warn you because it found the password in a known leak or because its security system detected risk. Treat the password as compromised even if you have not noticed unusual activity.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A password is reused when the same password, or a recognizably similar version, protects more than one account. Reuse turns one disclosure into a chain risk: an attacker can try the exposed credential on email, banking, shopping, social, gaming and other services. The Federal Trade Commission (FTC) says, “If you reused the same password, or a similar one, on other services, change it there, too.” FTC password guidance
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do these things first
- Check the alert without using its link. Open the service’s official app or type its address yourself. Unexpected messages can be phishing attempts. For Google accounts, go directly to Password Checkup to confirm warnings and review unsafe saved passwords.
- Change the affected password. Create a password that is unique to that account and has not appeared in any previous version you used elsewhere. Make the change on the provider’s official site or app, not through a message link.
- Change every reused or similar password. Start with accounts that share the exact password, then replace passwords that use the same base word, pattern or predictable variation.
- Enable MFA. Add a second factor wherever the account supports it. CISA recommends MFA for email, financial, social, online-store, gaming and streaming accounts because it provides protection even when a password has been compromised. CISA: More than a Password
- Inspect the account if access may have occurred. Sign out of other devices and sessions, check recent activity, confirm recovery email addresses and phone numbers, and look for settings or messages you did not create.
- Use official recovery if you cannot sign in. Reach the provider’s recovery page through its official website or app. Do not pay a stranger who promises to restore the account.
How to verify a password warning safely
Use the account’s security center
Open a new browser window or the service’s installed app. Navigate to its security, privacy or account-protection area and look for the same warning there. If the warning is absent, treat the original message as suspicious until you independently confirm it. Do not copy a phone number, button or URL from an unexpected email or text.
Review browser-saved passwords
Google’s Password Checkup can identify unsafe saved passwords in a Google Account. Go to the checkup directly, review each result, and change passwords on the corresponding services. A browser warning is a prompt to investigate, not proof that the browser account itself was hacked.
Record what was affected
Before changing dozens of accounts, make a private list of the username, service, whether the password was reused, whether MFA is enabled, and whether you see unfamiliar activity. Do not write the old password in that list. This prevents missed accounts without creating another sensitive record.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Change passwords without creating a new chain of risk
Make each replacement unique
A replacement password should be used for one account only. Do not “rotate” the old password by adding a number, changing capitalization or appending the service name; a similar password can remain guessable and still exposes other accounts if the pattern is discovered. A password manager can generate and store different passwords, but the important requirement is uniqueness.
Prioritize accounts in the right order
- Primary email. Email often receives password-reset messages, so secure it before less critical accounts.
- Financial and payment accounts. Change credentials and examine transactions or alerts for anything unfamiliar.
- Work, school and cloud accounts. These may contain documents, contacts or access to other services.
- Social, shopping, gaming and streaming accounts. Check profile, payment, messages and subscription settings after changing the password.
- Every other account sharing the credential. Search your password manager or browser vault for the old entry and replace each match.
Change passwords from a trustworthy device
If the warning is only a breach notification and the device behaves normally, change the password through the official service. If you suspect spyware, a malicious browser extension or another infection, follow the provider’s malware guidance before entering new credentials. Microsoft tells users recovering a potentially compromised Microsoft account to update protection and run a full scan before changing the password, then review connected accounts, forwarding and automatic replies. Microsoft compromised-account recovery guidance
That scanning precaution is for a potentially infected device; an exposed password alone does not establish that your computer or phone contains malware.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Turn on MFA and choose an appropriate factor
MFA requires more than the password—usually a code, approval, passkey or physical authenticator. It limits what an attacker can do with the password alone. Availability, enrollment screens and recovery options differ by provider and device.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Method | Phishing resistance | Account and device support | If the factor is lost | Setup considerations |
|---|---|---|---|---|
| FIDO passkey or security key | Strongest option among the methods discussed by CISA; FIDO is designed to block phishing attempts. | Only services and devices that support compatible FIDO authentication can use it. | Keep another registered factor or the provider’s recovery method; otherwise access can be difficult. | Register it in the account’s security settings and confirm compatibility before relying on it. A FIDO2 security key is optional, not required. |
| Authenticator app | Provides an additional factor, but the experience and phishing protection depend on the provider’s implementation. | Widely available on modern phones and many services. | Use the service’s backup codes or alternate recovery factor; protect those codes as carefully as a password. | Scan the provider’s enrollment code in the official app, then test a sign-in before ending the session. |
| Other provider-supported MFA | Protection varies by method and service. | Use what the account offers when stronger options are unavailable. | Confirm recovery choices while you are still signed in. | Read the provider’s instructions and keep recovery information current. |
CISA’s guidance explains why a phishing-resistant FIDO method is preferable where supported and identifies an authenticator app as another option. CISA MFA guidance Never buy a security key without checking that the account and your devices support the required FIDO standard.
Check whether the account was already accessed
End unknown sessions
Use the account’s “devices,” “where you’re signed in,” or “active sessions” page. Sign out of sessions you do not recognize and, when available, choose the option to sign out everywhere. This removes existing logins that may remain valid after a password change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Confirm recovery information
Check recovery email addresses, phone numbers, backup codes and authentication devices. Remove anything you did not add. An attacker who changes a recovery address can regain access even after you set a new password.
Inspect settings and activity
Look for changed profile details, unfamiliar connected apps, new forwarding rules, automatic replies, deleted messages, sent messages, purchases and subscription changes. For email and social accounts, review sent and deleted folders. The FTC’s account-recovery guidance specifically recommends checking account activity and settings and looking for unrecognized changes. FTC hacked-account recovery guidance
Warn contacts when necessary
If the account may have sent messages in your name, tell contacts not to open links or payment requests from those messages. This limits harm while you finish recovery. The FTC also advises notifying contacts when a hacked email or social account may have been used to contact them. FTC October 2024 account-hacking guidance
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What to do if you are locked out
- Navigate manually to the provider’s official sign-in page.
- Select the provider’s account-recovery or “forgot password” option.
- Follow the identity checks using a recovery email, phone, backup code or other method already associated with the account.
- If recovery details were changed, continue through the provider’s compromised-account process and provide the requested information.
- After recovery, set a new unique password, sign out other sessions, restore your own recovery details, enable MFA and inspect activity.
Do not send passwords or verification codes to someone who contacts you unexpectedly. The FTC’s recovery instructions are a useful starting point for hacked email and social accounts: How to recover a hacked email or social media account.
When a device scan belongs in the plan
Most exposed-password notices call for account changes, not an assumption that your device is infected. Consider a scan when you saw signs such as unfamiliar software or extensions, security tools being disabled, unexpected browser behavior, or an attacker-controlled account combined with suspicious device activity.
For Microsoft account recovery in a malware concern, Microsoft’s instructions say to update protection and run a full scan before changing the password. Afterward, review connected accounts, mail forwarding and automatic replies because an intruder may have created persistence or redirected messages. Follow the provider’s current instructions because labels and recovery steps can change.
Prevent the next password incident
- Use a different password for every account, especially email and financial services.
- Keep MFA enabled and register a backup factor or recovery method where the provider permits it.
- Review saved-password warnings through the provider or browser’s official security tools rather than through unexpected links.
- Keep recovery email addresses and phone numbers accurate, and remove old devices or authenticator entries.
- After a suspected takeover, check connected apps, forwarding rules, automatic replies and recent sessions—not just the password field.
- Store backup codes securely and do not place them in an unprotected note or share them in response to an unsolicited request.
Provider workflows and interface labels can change. If a menu item is missing, start from the service’s official help or security page rather than searching for a third-party recovery form.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
