How to Check If Your Email Was in a Data Breach
Billions of credentials from past breaches circulate online. Checking whether your email appears in them is quick, free and a useful reality check for your accounts.
How to check
- Use a reputable breach-notification service such as Have I Been Pwned, run by security researcher Troy Hunt. Type the address directly into the official site.
- Check each email address you use, including old ones.
- Consider subscribing to alerts for future breaches.
Is it safe to enter my email?
Reputable services only show breach names and do not need your password. Never type your password into a breach checker, and ignore sites that ask for it.
What the results mean
Finding your address in a breach does not mean your account was hacked. It means your address was in a leaked data set. The risk depends on what else was exposed, particularly passwords.
What to do next
- Change the password on any listed service and any account with the same password.
- Turn on two-factor authentication.
- Delete accounts you no longer use.
- Use a password manager to give every account a unique password.
- Be extra careful about phishing messages that mention the breached service.
Built-in checks
Many password managers and browsers now check your saved passwords against known breaches and warn you. Turn this feature on.
Key takeaway: Check your main email addresses through a trusted breach-checking service, then fix reused or exposed passwords and turn on two-factor authentication.
