How to Check Whether Your Password Has Been Leaked | What to Do First After a Breach
When a warning suddenly says “your password has been exposed”, it is hard to know where to start. This guide sorts out where leaks actually happen, the ways to check whether your own accounts are affected, and the order in which to act once you know a password has leaked.
Leaks happen on the service’s side, not on your device
When you see a leak warning, the first thought is often that your device has a virus. In practice, the more common case is that account details are stolen in bulk from a service you used, and the list then circulates. It can happen even if you did nothing wrong.
| Route | What leaks | Can you prevent it? |
|---|---|---|
| Breach at the service | Email addresses and passwords (depending on how well they were protected) | No. Stop reusing passwords to limit the damage |
| Phishing | Whatever you typed in, exactly as entered | Yes. Check the URL and where you are typing |
| Malware on your device | Saved passwords, anything you type | Yes. Keep things updated and avoid dubious software |
| Shoulder surfing in public | The password as you type it | Yes. Check your surroundings when typing |
| Easily guessed password | That one account | Yes. Make it long and random |
Since you cannot prevent the first row yourself, the focus of your defence is not “making sure nothing leaks” but “making sure a leak does not spread”. If you use the same password on several services, one breach means almost the same as all of your accounts being breached.
Four ways to check whether you have been affected
There are several ways to check. Rather than relaxing after one of them, go through them from the top and you will miss less.
- 1
Look at your browser’s or OS’s password check
Major browsers and smartphone operating systems can check whether your saved passwords appear in known breach lists. Run it from the password manager screen in settings and it lists passwords that are compromised, reused or weak. Opening this first is the quickest route.
- 2
Check for notices from the service
If a breach is confirmed, the operator may send a notice. Phishing that imitates such notices is common, though, so do not click links in the email; open the official site or app yourself and look for the announcement.
- 3
Check login history and sessions
Major services have a screen showing recent login times, locations and devices. An unfamiliar location or device is where actual damage is happening. From the same screen you can sign out unknown sessions one by one.
- 4
Look yourself up in a breach-check service
Some services let you enter an email address to see whether it appears in breach data that has been made public. Choose one run by a trustworthy operator and make sure it does not ask you to enter the password itself.
Signs to take seriously even without a notice
It can take time for a breach to be announced, and sometimes stolen data is abused without any announcement at all. Treat the following as prompts to check even if no warning has appeared.
- You get an unexpected “approve this sign-in?” prompt or a two-factor code. Someone is able to enter the correct password.
- Password reset emails arrive even though you did not request them.
- Your sent folder contains emails you did not send.
- Your login history shows activity you do not recognise, or you are logged out without reason.
- Spam suddenly increases. This can be a sign that your email address is circulating.
- Posts or follows you did not make appear on your social media accounts.
The first sign is especially urgent. If codes are arriving, the other party already knows your password and two-factor authentication is the last wall left. Never enter or share the code, and change the password straight away.
The order to act once you know about a leak
Trying to change everything at once takes time, and the damage can spread meanwhile. Work through the accounts with the biggest impact first.
- 1
Change your email account first
Email is where password resets for every other service arrive. If it is taken, whatever else you change can be taken back. Always put it first.
- 2
Change every service where you reused the same password
Changing only the breached service is not enough, because credential stuffing tries the same details on other services. Treat similar passwords, with just a digit or symbol added, as the same password.
- 3
Change services tied directly to money
Online banking, payment services and shopping sites. Also check that the registered payment methods and delivery addresses have not been changed.
- 4
Sign out every unknown session
Even after a password change, devices that are already logged in may remain. Run the equivalent of “sign out of all devices”.
- 5
Turn on two-factor authentication
Then a leaked password alone is no longer enough to get in. Keep recovery codes somewhere offline, for example printed out.
- 6
Generate new passwords randomly
If you think of new ones yourself, they tend to look like the old ones. Use a password generator to create a different string of 16 or more characters for each service and save them in your browser or password manager. The only one you need to remember is the one that opens it.
Prevention once things have calmed down
Once the emergency response is done, set things up so that the next leak does not spread. Only then does a breach notice become something you just check and move on from.
| Measure | Effect | Effort |
|---|---|---|
| Stop reusing passwords | A breach in one place no longer spreads to others | Large, but only the first time |
| Turn on two-factor authentication | Blocks intrusion even if a password leaks | A few minutes per account |
| Store passwords in a password manager | Lets you use unique passwords without memorising them | Automatic once set up |
| Run the breach check regularly | Shortens the time until you notice | A few minutes once a month |
| Keep contact details for key accounts up to date | Makes sure alerts reach you | Once only |
Changing passwords on a fixed schedule when there is no sign of a leak is no longer actively recommended, because forced regular changes tend to produce weak patterns where only the last digit changes. Think of two times to change a password: when a leak is suspected, and when you are clearing up reused passwords.
FAQ
- Is there a way to check whether my password has been leaked?
- Start by opening the password check built into your browser or smartphone OS. It lists any saved passwords found in breach lists, as well as reused or weak ones. Also look at each service’s login history for unfamiliar locations or devices. There are external services that compare your email address against breach data, but do not use any site that also asks for your password.
- Is a “your password has been leaked” warning genuine?
- Warnings shown in your browser’s or OS’s settings come from comparing saved passwords with known breach lists, and can be trusted. If a warning appears in an email or a pop-up on a website and the link asks you to log in, it may be phishing. If you are unsure, do not open the link; open the service yourself from a bookmark or the official app and check there.
- Once I know about a leak, which account should I change first?
- Your email account. Email is where password resets for other services arrive, so if it is controlled by someone else, changing the others will not help. Next come services where you reused the same password, then services tied directly to money. After changing, end sessions with the equivalent of “sign out of all devices” and turn on two-factor authentication.
- What should I do if I receive a verification code I did not request?
- Never enter or share the code, and change that service’s password straight away. If codes are arriving, the other party already knows your password and two-factor authentication is the only wall left. Sometimes a message asking you to tell them the code arrives at the same time, but a genuine operator will never ask for your code. After changing the password, check the login history and sign out any unknown sessions.
Tools in this article
Related articles
What Is a Passphrase? | How to Make a Password You Can Remember and Attackers Can’t Crack
A password built from the rule “mix upper and lower case, numbers and symbols, at least 8 characters” is hard to remember and not especially strong. What really determines strength is length, not the variety of character types. This guide explains how to make a passphrase, a string of words that gains its strength from length, and when to use one versus a random string.
Read article →Is Public Wi-Fi Dangerous? Settings for Using It Safely, and What Not to Do on It
Free Wi-Fi in cafés and airports is often dismissed as “too dangerous to use”, but now that almost all traffic is encrypted, the nature of the risk has changed. This guide covers the dangers that genuinely remain today, the settings to make before and after connecting, the things to avoid doing on public Wi-Fi, and how to protect yourself on the account side rather than the device side.
Read article →How to Share a Password Safely | Why to Avoid Email and Chat, and What to Use Instead
Handing a password to someone else is sometimes unavoidable, whether for a work handover or for managing household subscriptions. The problem is that most ways of handing it over leave it “sitting there long after you sent it”. This guide covers, in order, how to avoid sharing at all, a comparison of methods for when you have no choice, and how to tidy up afterwards.
Read article →