Every few weeks this year has brought another breach headline. The instinct is to feel vaguely exposed and then do nothing, because it's not clear what "exposed" even means for you personally. There's a fast way to turn that vague worry into a specific answer: check whether your own email address or password shows up in a known breach, using a free tool built for exactly this. Here's how to do it properly, and — the part most people skip — what to actually do once you have the results.

What Have I Been Pwned actually is

Have I Been Pwned (HIBP) is a free breach-lookup service built and maintained by security researcher Troy Hunt. It works by collecting data from breaches that have already happened — company disclosures, security researchers, sometimes stolen datasets circulating publicly — and indexing which email addresses and passwords appear in them, so you can search without downloading anything yourself. It's not a government tool, but it's trusted by governments: as of this year it's used by 47 national governments to monitor their own official domains for exposure, with Nepal the most recent to onboard. That's a reasonable signal that this is a legitimate, widely-relied-on service rather than a gimmick site — which matters, because breach-check clones and lookalikes do exist (more on that below).

Step 1: Check every email address you actually use

Go directly to haveibeenpwned.com — type the URL yourself rather than clicking a link from an email or ad. Enter your email address and search. Do this for every address you use, not just your main one: your old Hotmail or Yahoo account from a decade ago, your work email, the throwaway address you registered forums with. Old, half-forgotten accounts are frequently the ones sitting in the oldest, least-protected breaches, and if you ever reused a password from one of them anywhere else, that reuse is the actual risk.

Step 2: Read what the breach actually exposed — don't just skim the count

Seeing "this email appeared in 6 breaches" is not, by itself, useful. Click into each one. HIBP lists which categories of data that specific breach exposed — for example email addresses, passwords (usually stored as hashes, sometimes plaintext depending on how badly the company handled security), names, phone numbers, physical addresses, or IP addresses. A breach that only leaked your email address to a marketing list is a different problem than one that leaked your email plus a plaintext password plus your home address. Triage by what was actually taken, not by the breach's name recognition.

Note also that HIBP keeps a separate category for "sensitive" breaches — sites where being listed as a member is itself sensitive (for example, adult content or health-related services). Those aren't shown in the default results; you have to explicitly opt in to see them, which is a deliberate privacy choice on HIBP's part, not a bug.

Step 3: Check your passwords separately from your email

HIBP has a second, distinct tool called Pwned Passwords, and it answers a different question: has this specific password ever shown up in a breach corpus, regardless of which site it was tied to? This matters because a password can be compromised even if your specific account wasn't the one breached — if you used the same password somewhere else that got hit. The tool is built so you never transmit your full password to check it: it uses a technique (k-anonymity) where only a small partial fragment of the password's hash is sent, and the match happens without HIBP ever seeing the whole thing. In practice, the takeaway is simpler than the mechanism: it's safe to check a password there, but never type a real password into any other "breach checker" site that isn't HIBP itself.

What to actually do with the results

This is the step people skip — they check, feel briefly alarmed, and close the tab. Work through this list for anything that came back:

  • Password shown as exposed: Change it now on that specific site — and on every other site where you used the same or a similar password. Be honest with yourself here; password reuse is the single biggest reason one old breach turns into multiple compromised accounts today.
  • Any account with an exposed password: Turn on two-factor authentication (2FA) or, where offered, switch to a passkey. This is the step that actually limits the damage if a password leaks again in the future — it's more durable than any individual password change.
  • Security questions or answers were part of the breach: Treat those specific answers as permanently public from now on. Don't reuse the real answer elsewhere; if the site lets you, replace it with a random string stored in a password manager instead of a true fact about yourself.
  • Financial details, government ID numbers, or SSN were part of the breach: This is beyond a password change. Check with the major credit bureaus about placing a credit freeze or fraud alert, and watch statements from that account for unfamiliar activity in the following months.
  • The breach is old and you've already changed the password since: You likely don't need to act again — but it's worth double-checking you never carried that old password forward into a newer account.
  • You found several old, reused passwords: This is the moment to start using a password manager to generate and store unique passwords going forward, so this exercise doesn't need to be a fire drill again next year.

Set up alerts so you're not doing this manually forever

HIBP has a free "notify me" subscription: register your email address(es) and it will email you automatically if they turn up in a future breach, rather than relying on you to remember to check. This is worth doing for every email you searched in Step 1 — it converts a one-time check into ongoing coverage without any recurring effort on your part.

What this tool can't tell you

Worth being honest about the limits here. HIBP can only report on breaches that have been discovered, disclosed, and loaded into its database — it has no visibility into data that's been stolen but not yet found, sold privately, or sitting in stealer-log dumps that never became public. A clean result ("good news — no pwnage found!") means no *known* public breach includes that email; it isn't a guarantee that your accounts are untouched, and it's not a substitute for basic hygiene like unique passwords and 2FA. Treat a clean search as one data point, not a clean bill of health.

One more thing: only trust the real site

Because breach anxiety is itself something scammers exploit, be deliberate about where you check. Use haveibeenpwned.com directly, not a link forwarded in an email or text claiming to be a "breach alert" — that's a classic phishing setup. The legitimate password-checking tool never needs your full password to do its job; if a site asks you to type in a complete password to "check if it's been breached," that's a red flag, not a feature.

Quick checklist

  • Search every email address you've ever regularly used at haveibeenpwned.com
  • Open each breach result and read what data was actually taken
  • Check your commonly-used passwords in the separate Pwned Passwords tool
  • Change any exposed password, everywhere you reused it
  • Turn on 2FA or passkeys on your important accounts, especially email
  • Freeze credit if financial/ID data was exposed
  • Sign up for free future-breach notifications on each email address
  • Start using a password manager if you haven't already