How to Check If My Password Has Been Leaked, Safely

There are two different questions hiding inside "has my password leaked", and most people only answer the easier one. Checking your email address tells you which breaches included you. Checking a password tells you whether the exact string you still type into login boxes is already sitting in attackers' lists. You need both — and the second is the one people avoid, because it sounds like handing your password to a stranger. Done right, it never leaves your device.

Two checks, not one

Start with your email address at Have I Been Pwned, the free breach lookup run by Australian security researcher Troy Hunt. Type in an address — no sign-in, no payment — and it lists the breaches that included it and what kind of data each one exposed.

But an email result does not answer the password question. A breach can list your address with no password attached, and that mostly means more spam and phishing attempts aimed at you. A breach that exposed a password you still use is a different situation: that login should be treated as known to attackers, whether or not anyone has used it against your account yet. The ASOS breach announced through its own app shows why the distinction matters: leaked data is rarely one tidy field.

So: email check first, password check second. The password check is where the interesting engineering lives.

How to check if my password has been leaked without sending it

The obvious way to check a password is broken by design. If you send the password itself to a checker, you have just given a stranger your credential. If you send its hash instead, you have not fixed much either: the hash of a common password can be reversed in microseconds against a table, and a breach list is exactly such a table. The full hash of a well-known password is effectively the password.

Have I Been Pwned's Pwned Passwords service gets around this with a technique called k-anonymity, and the mechanics are worth understanding before you trust any checker with anything. Your browser turns the password into a SHA-1 hash on your own device, then sends only the first five characters of that 40-character hash to the service. The service replies with every leaked hash suffix that starts with those five characters — typically around two thousand of them — and your browser looks for your full hash in that list locally. The service learns that you asked about one of roughly two thousand hashes, not which one. Your password, and even its complete hash, never leaves your device.

That is also the test for whether any other leak checker deserves your trust. If a site asks you to type a password and never explains what leaves your device, close the tab. A legitimate checker either hashes locally and sends a prefix, like this one, or it is the check built into your browser or password manager, which uses the same idea. A checker that wants the plaintext and offers no explanation is not a security tool; it is a collection form.

I ran the check myself against the service's public range API to see the numbers rather than take them on faith. For the canonical demo value — the one the service's own documentation uses as its example — the prefix returned 1,978 candidate suffixes, and the exact match carried a count of 52,372,427 appearances in breach data. A freshly generated random 32-character string, by contrast, came back with no match at all. The first result shows why a familiar password is finished the moment it leaks: attackers need only the string, not your account. The second is what a clean result looks like — with limits the last section covers.

The check your phone already does

If typing a password into any website still feels wrong, use the check you already own. Both major platforms now run this comparison for every password they save, and they do it without you visiting a checker at all.

On Google's side, open Google Password Manager — in Chrome under Passwords and autofill, or at passwords.google.com — and run Checkup. It sorts your saved passwords into three groups: compromised, reused, and weak. Compromised means the password has appeared in a known breach; that group goes first, always.

On Apple's side, open the Passwords app and tap Security. You will see the same three kinds of warnings: compromised, reused, and easily guessed. If you want the monitoring itself, make sure it is switched on under Settings, then Apps, then Passwords, where the Detect Compromised Passwords toggle lives. Apple says the comparison is privacy-preserving: it does not reveal your password information even to Apple.

Either route beats a one-off website check in one important way: it checks everything you have saved, not just the one password you remembered to worry about. Most people's worst leak is a password they forgot they reused.

Found a leak? Fix in this order

A leaked password is not a reason to panic — but changing one password and moving on is not a fix either. Work in the order account takeover actually follows.

First, your email account. Email is the reset mechanism for nearly everything else, so a leaked email password — or a leaked password reused on your email — outranks every other account, including your bank. Change it, give it a password used nowhere else, and turn on two-factor authentication.

Second, every other place you used that same password. This is the step people skip. Credential stuffing works precisely because reuse is common. A password flagged on a forum account you no longer care about is still a live key if it also opens your shopping or work accounts. Change it everywhere it appears, not just where it was flagged.

Third, turn on a second factor wherever it is offered, and consider whether the account even needs a password anymore. Switching an account to a passkey removes the shared secret entirely, which is the only fix that makes the next breach of that service irrelevant to you. A leaked password plus a second factor is a locked door; a passkey is no door at all.

Finally, check the account itself for signs someone already used the leak: unfamiliar login locations, changed recovery details, sent mail you did not write. A password appearing in breach data does not prove your account was opened — someone else may have chosen the same password and leaked it — but the risk is identical either way, so act as if the key is public until you have replaced it.

What a clean result does not prove

A "not found" result is good news with three limits, and all three are worth saying out loud. First, it only means the password is not in the breach data this service holds. A password stolen last week may not have surfaced in a public breach corpus yet. Second, it says nothing about strength. A long, unique password that has never leaked is safe; a short, guessable one that has never leaked is merely unlisted. Third, the email check and the password check stay separate: a clean password result does not mean your address was never in a breach, and a clean email result does not mean your password is safe.

So the routine is deliberately boring. Check your email addresses once, check your saved passwords with the tool already on your phone, replace anything flagged starting with email, stop reusing passwords, and add a second factor or a passkey where you can. Repeat every few months: new breaches land constantly, and today's snapshot says nothing about next quarter. The checking itself takes two minutes; most of the ten-minute total is changing passwords.

References

• How Pwned Passwords checks a password without seeing it (k-anonymity range API)
• Google support: change compromised passwords with Password Checkup
• Apple support: change weak or compromised passwords on iPhone
• Ken Privacy: how to check if your passwords have been leaked
• TechCity: data breach check — email vs password checks explained