Companies get hacked all the time, and your email address might have been caught up in one without you ever knowing. This guide shows how to check for free using Have I Been Pwned, and exactly what to do if your email shows up: change reused passwords, turn on two-factor or a passkey, and watch for follow-up phishing.
Why check?
It takes ten seconds, and it’s completely free.
How to check if your email was in a data breach: step by step
1Go to haveibeenpwned.com
Type your email address, and click Check.
If you were breached
- Change that password everywhere you reused it — Start with email, banking, and anywhere with saved payment info.
- Turn on two-factor, or set up a passkey — So a leaked password alone isn’t enough to get in.
- Watch for follow-up phishing — Breached data gets used to write convincing scam emails and texts.
A few tips
- Nobody legitimately charges to “fix” this — Have I Been Pwned is free. Anyone asking for payment to remove you is a scam.
- Use a password manager — A different password for every site means one breach can’t touch the rest.
- Bookmark the real site — haveibeenpwned.com, not a search ad or a look-alike.
Recap: check for a data breach
- Go to haveibeenpwned.com, type your email, click Check
- Breached? Change that password everywhere you reused it
- Turn on two-factor, or set up a passkey
- It’s free — never pay anyone to “fix” it for you
Printable quick guide
Frequently asked questions
Is Have I Been Pwned safe and free to use?
Yes. It’s a free public service run by security researcher Troy Hunt, with no account or download required. Nobody legitimately charges to “remove” you or “fix” a result.
What should I do first if my email shows up in a breach?
Change the password for that account, and anywhere else you reused it, starting with email, banking, and anything with saved payment information.
Does a breach mean someone has my current password?
Only if you’re still using the password that was exposed, or a close variation of it. That’s exactly why reusing passwords across sites is risky.
What if the breach checker finds nothing?
That’s good news, but it only reflects breaches that have been publicly identified and loaded into the tool, so it’s still worth checking back occasionally and using a different password on every site.
Related guides
- What to do if your email was hacked
- Passkeys: what they are and how to start using them
- Password managers: why you need one and how to start
Source: Have I Been Pwned