To check if your email was breached, go to haveibeenpwned.com, type your email address and press "Check". The site lists every known data breach that included your address, along with what data was exposed.
To check if your email was breached, go to haveibeenpwned.com, type your email address and press "Check". The site lists every known data breach that included your address, along with what data was exposed. If you appear in any breach, change that password and any reused copies of it, and turn on two-factor authentication.
Data breaches are now so common that most people who've been online for a few years appear in at least one. Being in a breach doesn't mean you've been hacked. It means a company you used lost data that included your email, and sometimes your password, phone number or address.
This guide shows you how to run the check safely, how to read the results, how to check passwords without revealing them, and a step-by-step plan for what to do next. If a breach exposed a password, replace it with a unique one from our free password generator.
In this guide:
A data breach happens when information held by an organisation is accessed or published without permission, through hacking, a misconfigured database or an insider. Breached data is often traded or posted online, where criminals use it in three main ways:
Your email address is the thread that ties breaches together, which is why checking it is the best place to start.
Have I Been Pwned (HIBP) is a free service run by security researcher Troy Hunt. It collects data from public breaches so people can check whether they were affected. It's widely used and recommended by security professionals and government agencies.
According to HIBP's FAQs, searches aren't logged, and some breaches that are considered sensitive are only shown to the verified owner of the address, not to anyone who searches.
| What you see | What it means | Priority |
|---|---|---|
| "No pwnage found" | Your address isn't in any breach HIBP has loaded | Low, but stay careful: not every breach is public |
| Breach with email addresses only | Your address is known to be valid; expect more spam and phishing | Low to medium |
| Breach including passwords | That password (often hashed) may be crackable or already public | High: change it everywhere you used it |
| Breach including phone numbers or addresses | Higher risk of smishing, scam calls and targeted fraud | Medium |
| Breach including dates of birth, security answers or partial card data | Information useful for identity fraud | High: review security questions and watch statements |
| "Paste" listed | Your address appeared in data posted publicly on a paste site | Depends on what was posted |
| Breach of a site you don't remember using | You may have forgotten an old account, or it came from a third party | Check whether you reused that password |
Pay most attention to the breach date. If you've changed your password since then, the leaked one is no longer valid on that site, though it might still be in use elsewhere.
HIBP also offers Pwned Passwords, which tells you whether a password has appeared in a breach. It's designed so the full password never leaves your device: your browser hashes the password with SHA-1 and sends only the first five characters of the hash. The service returns all matching hashes, and your browser checks for a match locally. This approach is known as k-anonymity.
Even so, there's a simpler and safer habit: don't type your real, current passwords into any website other than the one they belong to. Instead, use the breach alerts built into your password manager or browser:
| Tool | Where to find password checks |
|---|---|
| Google Password Manager (Chrome, Android) | passwords.google.com > Password Checkup |
| Apple Passwords (iPhone, Mac) | Passwords app > Security, or Settings > Passwords > Security Recommendations |
| Microsoft Edge | Settings > Passwords > Password Monitor |
| Firefox | Passwords (about:logins) shows breach alerts; Mozilla Monitor for email |
| 1Password, Bitwarden and similar | Watchtower or reports section |
These tools check your saved passwords against breach data and flag reused or weak ones too.
If you build sign-up forms, you can check new passwords against Pwned Passwords without sending them anywhere. The range endpoint is free and needs no API key. From a terminal:
# Hash the test password and take the first 5 characters
echo -n "password123" | sha1sum
# cbfdac6008f9cab4083784cbd1874f76618d2a97
# Ask for all hashes beginning with those 5 characters
curl -s https://api.pwnedpasswords.com/range/CBFDA | grep -i "C6008F9CAB4083784CBD1874F76618D2A97"The response lists hash suffixes with a count of how many times each was seen. A match means the password is known to attackers and shouldn't be allowed. Only ever test sample passwords like the one above, never real ones. Checking email addresses through the API is a different, paid endpoint that requires a key, and that key belongs on your server, never in browser code. We explain why in keeping API keys off the browser.
Work through the list in this order. Steps one to four do most of the protective work.
| Situation | UK action | US action |
|---|---|---|
| Card details exposed | Call your bank on the number on the back of the card; ask for a replacement | Same; review statements and dispute unknown charges |
| Identity data (date of birth, address, ID) | Check your credit file with Experian, Equifax or TransUnion; consider Cifas Protective Registration | Consider a free credit freeze with Equifax, Experian and TransUnion |
| Social Security number exposed | N/A | Freeze credit; see IdentityTheft.gov for a recovery plan |
| You've lost money | Report to your bank, then Action Fraud (England, Wales, NI) or Police Scotland on 101 | Report to your bank and at ReportFraud.ftc.gov |
| Company handled it badly | Complain to the company, then the ICO | Your state attorney general or the FTC |
For a worked UK example, our guide to the ASOS data breach shows these steps applied to a real incident.
Rather than checking manually, let breach services tell you:
Be careful with paid "dark web monitoring" upsells. Many simply repackage the same public breach data that's available free.
You can't stop companies being breached, but you can limit how much a breach hurts you:
Most people have more email addresses than they remember: an old Hotmail or Yahoo account from school, a work address, an address from a previous internet provider such as BT, Sky or Comcast, and aliases. Breaches from years ago often involve those older addresses, and they may still be the recovery address for an account you care about.
Make a quick list, check each one, and either secure it with a new password and 2FA or, if you no longer need it, update your accounts to use your main address and close it.
Go to haveibeenpwned.com, type your email address and press Check. The site lists known breaches that included your address and shows what data was exposed in each one.
Yes. It is a long-running free service run by security researcher Troy Hunt and is widely recommended. Its FAQ says searches are not logged, and sensitive breaches are only shown to the verified address owner.
No. It means a company you used lost data that included your email address. Your accounts are only at risk if the leaked password is still in use, or if criminals use the data for phishing.
Change the password on the breached site and anywhere else you used the same password, then turn on two-factor authentication, starting with your email account.
It is better not to type real passwords into any third-party website. Use the password check in your password manager, Chrome, Edge, Firefox or Apple Passwords instead.
You may have forgotten an old account, a company may have shared your data with a partner that was breached, or someone may have signed up using your address.
Not necessarily. Breach checkers only know about breaches that have been made public and loaded. Keep using unique passwords and two-factor authentication either way.
Use the Notify Me option on Have I Been Pwned, Mozilla Monitor, or the breach alerts built into your password manager or browser.
Last checked: 20 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
To set up two-factor authentication (2FA), open the account's security settings, find "2-step verification", "two-factor authentication" or "multi-factor authentication", choose a second factor such as an authenticator app, passkey or security key.
On 6 October 2026 ASOS app users received a push notification reading 'ASOS HACKED'. ASOS later confirmed attackers took customer profiles including names, addresses, phone numbers and emails, but not payment details or passwords. Here is a factual timeline and eight practical steps to stay safe.
To check Windows Firewall status, open Windows Security and select Firewall & network protection. Each profile (Domain, Private, Public) says whether the firewall is on, and the one you're using is marked active. netsh and PowerShell give the same answer in one line.
To check BitLocker status, search Start for Manage BitLocker, or run manage-bde -status in an admin Command Prompt. Look at Protection Status: Protection On means your drive is really protected. Fully Encrypted with Protection Off means it isn't, yet.