Free tools Windows power users keep installed
One-click scans. No signup required.
If a service reports a breach or you suspect someone accessed your account, change that account’s password and replace it everywhere else you reused it. Put your email and financial accounts near the top of the list: an inbox can receive password-reset links for other services, while a financial account may expose money or payment details. If you cannot sign in, use the service’s official account-recovery process—not a link in an unexpected message.
A breach notification does not by itself prove that someone took over your account. Treat it as a reason to act on every reused password, then check account activity and security settings for signs of access. The steps below follow U.S. consumer guidance from the Federal Trade Commission, with provider-specific examples from Google.
As an Amazon Associate I earn from qualifying purchases.
Why one breached password puts other accounts at risk
If you use the same password on several services, a password exposed in one breach may be tried on the others. The risk is not limited to the service that sent the notice: reused credentials can give an attacker a path into accounts that were not part of the original incident. The FTC identifies password reuse as a reason to use different passwords, and the Cybersecurity and Infrastructure Security Agency explains that compromised passwords can expose multiple systems. See the FTC’s two-factor authentication guidance and CISA’s strong authentication guide.
There are two related but distinct situations. A breach notice may mean a service’s stored information was exposed; it does not necessarily establish that anyone signed in to your particular account. A suspicious sign-in, changed password, or message you did not send is stronger evidence that the account itself may have been accessed. In either case, if the exposed password was reused, replace it on every account that shared it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Email needs special attention because an attacker who controls your inbox may be able to request password resets for other services and receive the reset messages there. The FTC describes that route in its account-recovery guidance. That is why securing the mailbox used for recovery should not be left until last.
What should I do first if my password was leaked?
Work through these steps in order, adjusting the order of the password changes to protect accounts that can unlock others. Use the service’s app or type its known address yourself; do not provide credentials through an unexpected email or text link.
- Confirm the warning through the service. Open the app or visit the service’s address directly and check its account-security notices. For an unsafe-password alert in a Google Account, Google advises going directly to Password Checkup to confirm the alert and review the password. Its instructions are in Change compromised passwords in your Google Account.
- Change the password on the affected account. Choose a new password, not a slight variation of the exposed one. If you can still sign in, change it in the service’s account or security settings. If the password was changed without your permission or the service blocks access, go to its official recovery page instead of repeatedly trying old credentials.
- Change every other account that used that password. Start with your email account, then banking and payment accounts, followed by accounts that can reset or grant access to others. Continue through shopping, social, cloud-storage, work, tax, and any other accounts where you used the same password. A password change on one service does not change it on the others.
- End sessions you do not recognize. Use the service’s control to sign out other devices or sessions if it offers one. Review signed-in devices and remove unfamiliar ones. Google recommends checking for and removing unfamiliar devices in its compromised-account instructions.
- Turn on two-factor authentication and verify recovery details. Enable two-factor authentication (also called two-step verification or multi-factor authentication) where available. Check that the recovery email address and phone number belong to you, and remove any details you do not recognize.
- Inspect the account for changes and messages you did not make. For email, check forwarding rules, sent mail, and deleted mail. For social accounts, review posts, messages, and contacts. If your account may have sent unusual links or requests for money, warn affected contacts not to act on them.
- Check other password records you control. Google Password Checkup can identify passwords saved in a Google Account that are exposed, weak, or reused. It does not establish the status of every password or account outside its scope. If you use another password-record system, review its official security tools or the records you keep.
Which password should I change first?
Change the breached account promptly, then prioritize reused passwords according to what an account can unlock or expose. The order below is a practical way to decide when you have several accounts to secure; it is not a claim that every account in a category has been accessed.
- Email used for account recovery: Protect the inbox that receives password-reset messages. Check its recovery address and phone number, active sessions, and forwarding settings as part of securing it.
- Banking, payment, and other financial accounts: Replace the reused password and review activity. If banking or identity details may have been exposed, contact the relevant financial institution or authority.
- Accounts that can reset or open other accounts: Include primary identity, cloud, work, and communications accounts where access could lead to other services or sensitive information.
- All remaining reuse: Do not overlook shopping, social, tax, or other accounts just because they seem less urgent. The shared password remains a route in until it is changed there too.
This prioritization follows the access those accounts can provide. The FTC and Google guidance establish the risk from reused passwords and the importance of securing recovery email; they do not prescribe a universal category-by-category sequence.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What if I can’t get into my account?
Use the provider’s official account-recovery instructions. Start from its known website or app, rather than following an unsolicited recovery link. The FTC’s guide to recovering hacked email or social accounts includes recovery routes for common services. Google also advises account recovery if someone changed account details or you cannot sign in; see Secure a hacked or compromised Google Account.
As soon as you regain access, secure the email account used to recover the locked account. If that mailbox is exposed or still uses the same password, it may provide another way to reset accounts. Then change the reused password on the other services and review the recovered account’s devices, recovery details, and activity.
If you suspect financial or identity information was used, contact the affected financial institution or relevant authority. For people in the United States who believe personal information was stolen, the FTC points to IdentityTheft.gov for reporting and a recovery plan.
How can I tell whether someone is still logged in?
Look for a section in the service’s security or account settings that lists devices, active sessions, or recent sign-ins. Review the entries and sign out or remove anything you do not recognize. The exact labels and controls vary by provider. Google’s compromised-account instructions include checking for unfamiliar devices and removing them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not assume that changing a password automatically ends every existing session. The available guidance does not establish a universal rule for how services handle sessions after a password change. Use the service’s explicit sign-out or session-management control, where available, and verify recovery details as well. An unknown recovery phone number or email address could let someone regain access even after you change the password.
What should I check after regaining access?
A password change addresses one way into an account; it does not reveal every setting or message altered while someone may have had access. Inspect the account itself for activity you did not initiate.
- Devices and sign-ins: Remove unfamiliar devices and end other sessions where the service lets you.
- Recovery routes: Confirm that recovery email addresses and phone numbers are yours.
- Email rules and messages: Look for forwarding rules you did not create, plus unexpected sent or deleted messages.
- Posts, messages, and contacts: On social and messaging accounts, look for activity that could have reached other people.
- Financial or identity activity: If relevant information may have been exposed or used, contact the financial institution or authority responsible for the affected account or information.
If contacts may have received messages from your account, tell them to ignore unusual links or requests for money. The FTC also advises people recovering hacked accounts to update computer security software and run a scan; this is a general protective step, not a substitute for changing passwords and securing account access.
Recommended Free Tools
How to prevent the next password-reuse problem
Use a different password for each account. A password manager is one optional way to generate and keep track of unique passwords; Google recommends using one as a way to create and manage strong, unique passwords. It is a follow-up aid, not a prerequisite for responding to a breach. When choosing one, consider whether it can generate unique passwords, work across the devices you use, and provide a recovery process you understand.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Two-factor authentication adds another check beyond the password. The FTC describes common second factors such as a code, an authenticator app, or a security key. Its guidance characterizes security keys as the strongest common 2FA method it discusses, but an option is useful only when the account supports it and you can recover access if the key is lost. A FIDO2 security key is a physical device used as a second factor on compatible accounts; it is optional and not required to replace a password.
When comparing authentication choices, check account support, everyday usability, recovery options, and how well the method resists credential theft. Turn on the strongest practical option the service supports, and keep recovery information current. Neither a password manager nor a second factor removes the need to change a password that was reused and exposed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to treat a warning as a possible account takeover
A service’s breach notice and a warning sign of account takeover are not the same thing. The FTC lists being unable to sign in, an unexpected username or password change, unfamiliar sign-in notices, and messages you did not send as signs that an email or social account may have been hacked. If you see one of these, use the provider’s recovery process if necessary and review the account’s access and settings after recovery.
If you only received a breach notice, you may not know whether your specific account was accessed. Still, change the exposed password anywhere you reused it, because another service may be targeted with those credentials. Do not infer that every account was entered or that every password change ends all existing sessions; confirm access using each provider’s account-security controls.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently Asked Questions
I use the same password everywhere—what should I change first?
Change the password on the affected account, then replace it on every account where you reused it. Prioritize your recovery email account and financial accounts, followed by services that can reset or open other accounts. Continue through shopping, social, cloud, work, tax, and any other reused accounts; changing it on one service does not update the others.
Should I change my email password too?
Yes, if the breached password was also used for your email account. Secure the inbox that receives password-reset messages as a priority, and verify its recovery phone number, recovery email, sessions, and forwarding rules. Someone with inbox access may be able to reset passwords on other services.
What if I can’t get into my account?
Go to the provider’s official website or app and follow its account-recovery instructions. Do not use an unsolicited link. Once you regain access, secure the email account used for recovery, change the reused password on other services, and review devices, recovery details, and recent activity.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow do I know if someone is still logged in?
Check the service’s security settings for active sessions, devices, or recent sign-ins. Sign out other sessions or remove unfamiliar devices if the service offers that control. Do not assume a password change ends every session; session controls vary by provider.
Does a breach notice mean someone accessed my account?
Not necessarily. A breach notice may mean information held by a service was exposed, but it does not by itself prove that your individual account was accessed. Change the exposed password anywhere you reused it, and look for signs such as unfamiliar sign-ins, changed account details, or messages you did not send.
Should I use a password manager or security key right now?
Neither is required to respond to a breach: change the exposed and reused passwords first. A password manager can help create and manage unique passwords. A security key, including a compatible FIDO2 key, is an optional second factor where the service supports it; consider recovery options and account compatibility.
The Bottom Line
Bottom line: Change the breached password, replace every reuse—starting with email and financial accounts—and use the provider’s official recovery process if locked out. Then end unfamiliar sessions, verify recovery details, enable two-factor authentication where available, and inspect account activity.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
