Check If Password Is Compromised: 7 Ways

The most direct way to check if a password is compromised is to use a data-breach search service, such as Have I Been Pwned, which compares your email or password against billions of leaked credentials. These services tell you whether your exact password has appeared in a known breach, so you can change it immediately if it has. Below are the most reliable methods, how they work, and what to do if your password shows up.

What Does “Compromised” Actually Mean?

A password is considered compromised when it has been exposed in a data breach, meaning it is publicly available to attackers, often in a file of hashed or plaintext passwords. Even if your account hasn’t been logged into, the mere exposure means it can be used for credential stuffing attacks, where attackers try it on many websites. The severity depends on whether the password was stored in plaintext (immediately readable) or hashed (scrambled), but any exposure should be treated as a risk.

Why Breach Databases Exist

When a company suffers a data breach, security researchers and journalists often obtain the leaked data and compile it into searchable databases. The largest public service is Have I Been Pwned (HIBP), created by Troy Hunt in 2013, which has indexed over 12 billion accounts. Other services include DeHashed, IntelligenceX, and the Firefox Monitor. These databases allow anyone to check if their credentials appear in known breaches, without needing to download the raw (and often illegal) data themselves.

Method 1: Check Your Email Address

The simplest first step is to check your email address on a breach aggregator. This reveals which breaches your email was involved in, but it does not tell you which password was exposed. For example, if your email appears in a LinkedIn breach, you know the password you used there is compromised. This is useful because you can then change that specific password and any other accounts using the same one.

Go to haveibeenpwned.com and enter your email.
Review the list of breaches; note the website and the year.
Change the password for that site and any other site where you reused it.

Method 2: Check the Password Itself

To check a specific password, use the “Pwned Passwords” feature on HIBP or similar services. This does not send your password over the internet; instead, it uses a technique called k-anonymity. Your password is hashed (using SHA-1), and only the first 5 characters of that hash are sent to the server. The server returns all hashes that start with those 5 characters, and your browser checks locally if your full hash matches any. This way, your full password never leaves your device.

Method 3: Use a Password Manager

Most reputable password managers (like Bitwarden, 1Password, or KeePass) have a built-in breach check feature. They compare your stored passwords against known breach lists and flag any that appear. This is convenient because it checks all your passwords at once, and many managers also warn you about weak or reused passwords. If you don’t use a password manager, you can manually check each important password using the method above.

Method 4: Check for Credential Stuffing Attacks

Even if your password isn’t in a breach database, it may have been used in an attack. If you notice suspicious login attempts or unauthorized access, your password may be compromised even if it’s not listed. Check your account activity logs for logins from unfamiliar locations or devices. If you see any, change your password immediately and enable two-factor authentication (2FA).

What to Do If Your Password Is Compromised

Change it immediately for the affected account and any other account using the same password.
Create a unique, strong password for each account, ideally 12+ characters with a mix of letters, numbers, and symbols.
Enable two-factor authentication on all important accounts (email, banking, social media).
Update your recovery email and phone number to ensure you can regain access if locked out.
Monitor your accounts for any unusual activity over the next few weeks.

Common Misconceptions

One common myth is that a password is safe if it’s not in a breach database. In reality, new breaches happen daily, and databases may not be up to date. Another misconception is that changing your password frequently makes it safer; in fact, it’s more important to use a unique, strong password and enable 2FA. Also, “password123” or “123456” are always compromised because they are among the most common passwords, even if they don’t appear in a specific breach list.

Frequently Asked Questions

Is it safe to check my password on Have I Been Pwned?

Yes, because of the k-anonymity method, your full password is never sent to the server. Only a partial hash is sent, and the matching is done locally on your device. This is considered safe and is used by many security professionals.

What if my password appears in a breach, but I changed it already?

If you changed it after the breach, your current password is likely safe. However, if you reused the old password elsewhere, you must change it there too. Also, if the breach was recent, monitor your accounts for suspicious activity.

Can I check if my password is compromised without using a website?

Yes, you can download the Pwned Passwords list (a large file) and search it locally using a script or a tool like grep. This is more private but requires technical knowledge and storage space (the list is several gigabytes).

Does a breach check work for passwords stored in password managers?

Yes, most password managers integrate with breach databases. They check your stored passwords against the same lists, and some even warn you in real-time if you’re about to use a compromised password.

How often should I check my passwords?

It’s a good habit to check every few months, or whenever you hear about a major breach affecting a service you use. You can also subscribe to breach notification services that alert you if your email appears in a new breach.

What if my password is compromised but I have 2FA enabled?

2FA adds an extra layer of protection, so even if your password is known, attackers would also need your second factor (like a code from your phone). Still, you should change the password, because 2FA can be bypassed in some attacks (e.g., SIM swapping).

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →