Company breaches can expose email addresses, usernames, passwords, and personal details without you noticing. A breach check tells you which accounts and reused passwords need attention first.
Does this affect you?
Use this for any email address, regardless of provider, when you want to know whether it appeared in a known breach.
Check with Have I Been Pwned
This is the best-known free public breach lookup.
- Go to haveibeenpwned.com.
- Enter your email address and choose pwned.
- Review the listed breaches, dates, and exposed data types.
- Use Notify me if you want alerts when the email appears in future breaches.
- Use the separate Pwned Passwords tool if you want to check a specific password. It is designed to check securely without sending the readable password.
Use built-in breach checks
These check saved passwords inside your browser or account.
- Google Password Manager: go to passwords.google.com and run Password Checkup for breached, weak, and reused passwords.
- Apple: on iPhone or Mac, open Passwords or Settings/System Settings > Passwords > Security Recommendations.
- Microsoft Edge: open Settings > Profiles > Passwords and look for Password Monitor.
- If you use a dedicated password manager, use its breach-monitoring or watchtower feature instead.
What to do with the results
Finding a breach is common. The response matters more than the discovery.
- Change the password on the breached account first, especially if the breach included passwords.
- Change the same password anywhere else it was reused. Credential stuffing attacks rely on password reuse.
- Turn on two-factor authentication for the breached account and critical accounts such as email, banking, and social media.
- Watch for phishing messages that reference the breached company or use real personal details.
More control
Breaches expose different data
Some breaches expose only email addresses or names. Others include passwords, addresses, phone numbers, payment details, or more sensitive data.
Old breaches still matter
Breach data circulates for years. If you still use the same password anywhere, an old breach is still relevant.
Password reuse is the real pattern
A password manager makes every account unique so one company breach does not become a many-account problem.
Sources
- Have I Been Pwned – About this site (2025)
- Google Account Help – Check if your password is compromised (2025)
- Apple Support – About Security Recommendations on iPhone (2025)