You can check whether a password has appeared in a known data breach by typing it into the Pwned Passwords page. The check is designed so your actual password never leaves your device. If the password turns up, stop using it everywhere. Change your email password first, then every account that shared the leaked password. Most people can get through that list in under an hour.
The rest of this article covers why the check is safe to use, what a "found" result does and doesn't mean, and the order to work in afterward.
Two different questions: "Was my account breached?" and "Is my password known?"
Have I Been Pwned, run by security researcher Troy Hunt, answers two separate questions, and people mix them up constantly.
- The email search on the front page tells you whether your email address appeared in a specific breach, such as a forum or shop that got hacked. It names the breach and lists what types of data were exposed.
- Pwned Passwords tells you whether a particular password appears anywhere in a very large collection of passwords taken from many breaches. It doesn't know whose password it was.
That second point matters. If your password shows up in Pwned Passwords, it may not be your leak. Someone else may have chosen the same password. That changes less than you'd think. Attackers try passwords from this collection first, because people pick the same ones. A found password is a weak password no matter whose leak put it there.
How the check works without seeing your password
It sounds like a bad idea to type your password into a website to find out whether it's leaked. Pwned Passwords uses a technique called k-anonymity to avoid that problem. Here it is without the math:
- Your browser turns your password into a hash: a fixed-length fingerprint, here 40 characters long using SHA-1. The same password always produces the same fingerprint, and you can't run the fingerprint backward to get the password.
- Your browser sends only the first 5 characters of that fingerprint to the service.
- The service replies with the rest of every fingerprint in its database that starts with those 5 characters, along with how many times each one has been seen. That is typically several hundred entries.
- Your browser compares the list against your full fingerprint on your own device and tells you whether there's a match.
There are about a million possible 5-character starts (16⁵ = 1,048,576), and every one of them is shared by hundreds of known passwords and by countless passwords nobody has ever leaked. The service learns that you asked about one of a large crowd, and nothing more. It can't tell which one you meant, or whether you got a match. The API documentation also describes an optional "padding" mode. It adds fake entries to each reply, so that even the size of the response gives nothing away.
This is the same check that many browsers, password managers, and corporate login systems run in the background. NIST's digital identity guidelines, SP 800-63B, tell services to compare new passwords against a list of known-compromised ones and reject matches. If a site has ever refused your password with "this password has appeared in a breach," this is probably what happened behind the scenes.
A sensible caution: only type a password into the official page, or a tool you already trust that uses this API. A page that merely claims to check your password is a great way to collect passwords. That's how a lot of people end up needing this article.
What a result means
- Found, with a count. The number is how many times that exact password appeared in the breach data. "Seen 1 time" and "seen 2 million times" both mean the password is in attackers' lists. The higher count means it will be tried sooner.
- Not found. Good, but it doesn't make the password strong. It only means it isn't in this collection. Length still does most of the work; see how long a password should be.
The next hour: what to do, in order
The order matters more than speed. On the helpdesk, the costly cases were rarely "someone got into my shopping account." They were "someone got into my email, and then into everything that sends password resets to it."
- Change your email password first. Your email inbox is where password reset links for nearly every other account go. If an attacker controls it, they can take back any other account you secure. Choose a new password you have never used anywhere else.
- While you're in the email account, sign out of all other sessions. Most big providers have a "sign out everywhere" option, or a list of devices you can remove. Changing the password doesn't always end sessions that are already logged in.
- Check the email settings an attacker would change. These are quiet and easy to miss: - the recovery phone number and recovery email, - forwarding rules and filters, especially ones that forward mail elsewhere or auto-delete messages about passwords or security, - connected apps or "app passwords" you don't recognize.
- Turn on two-step verification for email if it isn't on already. An app or a hardware key is better than text messages, but text messages are much better than nothing.
- List every account that used the leaked password, or anything close to it. "Summer2023!" and "Summer2024!" count as the same password to an attacker. Prioritize in this order: - banking and payment accounts (including PayPal-type services and saved cards in shopping accounts), - your phone carrier account, because control of your number means control of text-message codes, - cloud storage and photos, - work accounts. Tell your IT team rather than quietly fixing it yourself; they would genuinely rather know, - social media, - everything else.
- Give each account its own new password. This is the step people skip. If you don't use a password manager, now is the easiest time to start, because you're already retyping all of them. For how to pick something strong that you can still remember, see passphrase vs. random password.
- Turn on two-step verification for the high-priority accounts from step 5, at least banking and your phone carrier.
- Expect phishing for a few weeks. After a breach, the people holding the data often send convincing "unusual activity, confirm your account" emails. Reach your accounts by typing the address or using the app, not through links in messages.
If you run out of time in the hour, steps 1–4 are the ones that can't wait. The rest can be finished tonight.
What you don't need to do
- You don't need to change every password on a schedule. NIST stopped recommending forced periodic changes years ago. People forced to change passwords every 90 days tend to pick predictable variations, and attackers know the patterns. NIST's guidance is to change a password when there's evidence it's been compromised, which is exactly what a positive Pwned Passwords result is.
- You don't need to close accounts in a panic. Securing them is enough. Deleting an old account you no longer use is reasonable, but do it after the urgent work.
- You don't need to buy anything. Every step above can be done with free tools and the settings pages of the accounts themselves.
How to make the next leak boring
The goal isn't to never appear in a breach. Some site you signed up for in 2014 will eventually lose its database, and that's outside your control. The goal is for that breach to cost you one password on one site, not your email and everything attached to it. Unique passwords and two-step verification on your email account do most of that work. Once both are in place, the next breach notification means about five minutes of work instead of an hour.