Change the exposed password immediately—first on the service that reported the breach, then everywhere you reused it or a recognizable variation. Use a different, unique password for each account. Exposure does not prove anyone accessed your account, but you should no longer trust that password.
What to do first
- Go to the affected service directly. Open its known app or type its address yourself rather than following an unexpected breach or password-reset link in a message.
- Change the password on the service that reported the breach. Choose a new password that is unique to that account and unrelated to the exposed one. The FTC advises changing it right away when a company or website reports losing it in a breach: Creating Strong Passwords and Other Ways To Protect Your Accounts.
- Find and change every reuse. Check other services where you used the exact password or a recognizable variation. Change each one to a distinct password; adding a digit, symbol, or minor spelling change does not make a reused password safe. The FTC specifically advises changing the same or similar password on other services.
- Prioritize high-impact accounts. If you reused the password for email, financial services, or accounts used to reset other logins, secure those promptly. CISA identifies email and financial services as important places to use multifactor authentication: More than a Password.
Choose a replacement you will not reuse
Give each account its own new password rather than adapting the exposed one or borrowing a password from another account. A password manager can generate and store distinct passwords, so you do not have to remember every one. CISA recommends considering whether a manager works with your devices, how it stores credentials, how account recovery works, and whether multifactor authentication is available: Use a Password Manager to Create and ‘Remember’ Strong Passwords.
As an Amazon Associate I earn from qualifying purchases.
Before moving all your credentials into a manager, make sure you understand how you would regain access if you lose your device or forget the manager’s master password. Turn on MFA for the manager itself if it offers it.
Turn on multifactor authentication
MFA adds a second verification step beyond the password. Enable it on important accounts wherever the service offers it, especially email and financial services. The exact methods and setup vary by service; FTC and NIST describe options including text messages, authenticator apps, and security keys.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | What to consider |
|---|---|
| Text message (SMS) | Convenient, but the FTC describes SMS as the least secure of the MFA options it discusses. Use a stronger available method if practical. |
| Authenticator app | A commonly offered alternative to SMS. Check that it works on your devices and understand how you would recover access if you lose or replace a device. |
| Hardware security key | An optional physical key, often marketed as a FIDO2 security key. It can be useful only on accounts that support it, and you must enroll it on each account. Check compatibility and recovery options before relying on one. |
FTC’s guide to choosing and setting up methods is Use Two-Factor Authentication To Protect Your Accounts. NIST also outlines MFA forms in How Do I Create a Good Password?. A security key is optional; it does not replace changing reused passwords.
Check whether anyone actually accessed an account
A password appearing in a breach is not, by itself, proof that someone signed in. Review recent account activity and security or recovery settings for unfamiliar changes. Look for unexpected sign-ins, changed recovery details, messages you did not send, or other activity the service identifies as suspicious.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you find signs of unauthorized access, use that service’s account-recovery and security process, change the password, sign out other sessions where possible, and enable two-factor authentication. The FTC’s guidance for compromised email or social accounts explains these recovery steps: Email or social media hacked? Here’s what to do.
Free tools Windows power users keep installed
One-click scans. No signup required.
Work through the rest of your accounts
If you are unsure where you reused the password, check accounts where you commonly signed in with it and any saved logins in your password manager or browser. Change every match and similar version, not just the account named in the breach notice. As you work through the list, give priority to accounts that can expose sensitive information or help reset access to other services.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
