How to check whether your password has already leaked

Yes, you can check, and the good services do it without ever learning your password. The standard method sends a five character fragment of a scrambled version of your password, gets back a few hundred possible matches, and compares them on your own device. Your browser and your password manager almost certainly run this check already and are waiting to tell you. The part most people get wrong is what a hit means: it says this exact password appears in a public collection of leaked credentials, not that your account was broken into. That still matters, because attackers work from the same lists.

How a check works without seeing your password

The technique is called k-anonymity range checking, and it is worth understanding because it is the difference between a trustworthy checker and a reckless one.

Your device turns the password into a hash, a fixed length string of characters produced by a one way calculation. The same password always produces the same hash, and you cannot run the calculation backward. Your device then sends only the first five characters of that hash to the service. The service replies with every stored hash that begins with those five characters, usually several hundred of them, along with how many times each has been seen. Your device finishes the comparison locally.

Two things follow. The service never receives your password, and it never even receives the full hash, so it cannot tell which of the several hundred answers was the one you asked about. The list comes back the same whether your password is in it or not.

The best known public service, Have I Been Pwned, offers exactly this range interface, which is why browsers and password managers build on it rather than inventing their own. If a checker explains that it works this way, that claim is testable and other people have tested it.

What a match actually means

A match tells you one specific thing: this string has appeared in credential data that circulates publicly. It does not tell you when, where, or whether it was ever yours.

Consider two readers who both get a hit. The first uses a password like Summer2019! that millions of strangers also chose. It shows up with a huge count because of them, and there is no evidence connecting the leak to any account of theirs. The second uses a long unique phrase that appears exactly once. That single hit is far more serious, because the only realistic way it entered the corpus is through a site they used.

So read the count as a clue about origin, not about severity. A high count means the password was always guessable and should go regardless. A count of one or two against something you thought was unique means a service you trusted lost your credentials, and the same or similar password is likely to be tried elsewhere by automated tools, which is the mechanism explained in why reusing one password costs so much.

The reverse is also true and less comfortable. No match does not mean safe. Breached data often sits in private hands for months or years before it becomes public, and plenty never circulates at all. A clean result means nobody has added your password to the public pile yet, which is worth knowing and is not a certificate.

The places you can check

Start with the third row, because it costs nothing and covers everything at once. In Chrome and Edge the feature is called Password Checkup or Password Monitor, in Safari and on iPhone it is Security Recommendations under Passwords, and in Firefox it sits inside about:logins. The mechanics of those vaults, and when they are the right place for your logins at all, are covered in the case for and against browser saved passwords. A dedicated password manager runs the same audit across every account rather than only the ones one browser saw.

Checking by email address instead

An email lookup answers a different question: which companies that held your address have been breached. You will usually get a list of named incidents with a date and a description of which fields were exposed, and that description is the useful part.

Read it field by field. Email address and password hash means change that password now. Email address and date of birth and phone number means no password to change, but a better equipped scammer, because those details make an impersonation call sound legitimate. Security question answers are worse than passwords in one respect: your mother's maiden name cannot be rotated. What each category of exposure actually costs you is laid out in what a data breach means for you.

Check every address you use, including the old one you keep for shopping, and the work address if your employer allows it. Most people find their oldest mailbox in the most incidents, simply because it has existed the longest.

Dark web monitoring and what it can deliver

Banks, insurers, antivirus companies and credit bureaus all sell dark web monitoring, often bundled into something you already pay for. It is worth being precise about what the product is.

The vendor maintains a collection of leaked data gathered from dumps, forums and paste sites, and matches your details against it as new material arrives. That is a real service and the alerts can be genuinely early. What it is not is a live search of hidden networks, and no vendor can delete your data once it is out, whatever the marketing implies. If a breach never gets traded publicly, monitoring never sees it.

The honest version: free tools catch most of what matters for email addresses and passwords. Paid monitoring earns its place mainly when it adds credit file alerts, because credit applications are where stolen identity data turns into money, and that is a different alarm from a leaked login. The early warning signs are in the first signals of identity theft.

When to close the tab

Some sites ask you to type your full password into a box and press check. Treat that as disqualifying unless the page clearly explains that the calculation happens in your browser and nothing is transmitted. There is no technical reason to send a whole password to find out whether it has leaked, and a site that does it either does not know the safe method or does not care.

Two other warnings. A checker that asks you to sign in with your Google or Apple account to see the result is collecting something it does not need. And an unsolicited message telling you your password has leaked, with a link to check, is a standard phishing setup, because a warning about security is the easiest way to get someone to type a password in a hurry. If you want to test how strong a candidate password is rather than whether it leaked, use a checker that scores it in the browser such as this password strength tool.

What to change, and in what order

Order matters, because changing things in the wrong sequence lets an attacker who is already inside undo your work.

1. Your main email account first, whatever the checker flagged. It receives the reset links for everything else, so a new password there has to land before the others.
2. While you are in that account, check the settings an intruder would have changed: forwarding rules, filters that delete incoming mail, recovery phone numbers and alternate addresses, and connected apps.
3. Use the sign out of all sessions option on email and any other flagged account. A password change alone does not always kill an existing session, and a stolen session cookie keeps working until it does.
4. Turn on a second factor on that account before moving on. A leaked password matters far less once the password by itself is not enough.
5. Now change the flagged password everywhere it was used, and anywhere you used a near variant of it. Numbers on the end do not count as different.
6. If the breach exposed more than credentials, follow the wider sequence in the checklist for after a breach, including watching statements and freezing credit where that applies.

Then make the check routine rather than an event. Once a quarter, open the audit in your manager or browser, clear whatever it flags, and start with anything reused. Ten minutes, four times a year, deals with almost everything a monitoring subscription would have told you.