Has my password been leaked? How to check and what to do

To find out if your password has been leaked, check it against a list of passwords exposed in real data breaches. The eThorns leaked password check does this without sending your password anywhere. If it shows up, stop using it and change it on every account where you used it, starting with your email and your bank.

What a data breach and a leaked password list are

A data breach happens when someone steals a company's customer data: names, email addresses and, very often, passwords. Sites should store passwords scrambled, but some store them badly, and weak passwords can be recovered from the stolen copy.

After a breach, the stolen email and password pairs get copied, merged and shared. Over the years this has built huge lists of real passwords that anyone can get. Have I Been Pwned, a free service run by security researcher Troy Hunt, gathers them into one searchable list so people can check whether theirs is among them.

Why reusing a password is the real danger

A leaked password used on one site is a problem for one account. Used on ten sites, it is a problem for ten. Attackers know that many people reuse passwords, so they take the email and password pairs from one breach and try them automatically on email services, banks, online shops and social networks. This is called credential stuffing. A program tries thousands of logins and keeps the ones that work.

That is why the most important rule is not "use a complicated password". It is "use a different password on every site". If a small shop at tienda-ejemplo.co is breached, a unique password there means the damage stops there.

How the check works without sending your password

The check is built so that your password never leaves your device. It uses a hash: a kind of fingerprint of a piece of text. The same text always gives the same hash, but you cannot turn the hash back into the text.

Step	Where it happens	What travels
Your browser turns the password into its SHA-1 hash, 40 characters long	Your device	Nothing
It sends only the first 5 characters of that hash	To Have I Been Pwned	5 characters, for example 5BAA6
The service replies with every leaked hash that starts the same way, plus fake entries as padding	From Have I Been Pwned	Hundreds of hash endings
Your browser looks for your full hash in that list	Your device	Nothing

For example, the SHA-1 hash of the word password is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. Only 5BAA6 is sent. Hundreds of different leaked passwords share that start, so the service cannot tell which one you checked. This method is called k-anonymity: your request hides among many possible answers. The padding means someone watching the network cannot learn anything from the size of the reply either.

The eThorns tool shows you the 5 characters it sent, so you can see exactly what left your device. If there is a match, it also tells you how many times that password was seen in breaches.

How to check your password, step by step

1. Open the leaked password check and type the password.
2. Press Check. Your browser computes the hash and sends only its first 5 characters.
3. Read the result. "Not found" means the password is not in the breach lists Have I Been Pwned knows about. "Found" means it is in attackers' lists, even if the leak was not from your account.
4. To see which breaches included your email address, search it on haveibeenpwned.com.

What to do if your password appears

Don't panic, but don't wait either. A found password will be tried by attackers sooner or later, so treat it as public.

1. Write down every account where you used it, including slight variations like adding a number at the end. Attackers try those variations too.
2. Change your email password first. Your email can reset almost every other password, so whoever controls it controls the rest.
3. Then change your bank and payment accounts, and anything linked to a card, such as online shops and delivery apps.
4. Then the rest: social networks, work accounts, and any old account you still care about. Delete the ones you no longer use.
5. Use a new, different password for each one. The password generator creates them on your device and sends nothing.
6. Look for signs of trouble. In your email, check the list of signed-in devices, your recovery phone and address, and any forwarding rules you did not create. In your bank, check recent movements.
7. Turn on two-step verification on your email and bank (see below).

After a well-known breach, fake "reset your password" emails usually follow. Change passwords by typing the site's address yourself, not from a link in a message. Our guide on how to check if a link is safe explains how to spot those.

Strong passwords you can actually remember

Current guidance from the US standards agency NIST, in SP 800-63B, favors length over complexity. It tells websites not to force mixes of symbols and capitals, not to make people change passwords on a schedule (only when there is evidence of a leak), and to check new passwords against lists of breached and common passwords. In short: long and unique beats short and strange.

You only need to remember a few passwords. For everything else, use a password manager: an app that stores all your passwords encrypted behind one main password and fills them in for you. The one built into your phone or browser is a good start.

For the few passwords you type by hand, such as the password manager itself, your computer and your email, use a passphrase: several random words in a row. A phrase of random words is easy to picture and type, and hard to guess because of its length. The words must be chosen at random, not taken from a song or a saying. In the password generator, pick Passphrase and it shows the strength in bits for the exact result. With its built-in word list it suggests 8 words or more.

Turn on two-step verification

Two-step verification (also called 2FA or MFA) asks for a second proof after your password, usually a code from an app on your phone, a security key or a passkey. With it, a leaked password alone is not enough to get into your account.

1. Go to the security settings of your email and your bank first.
2. Choose an authenticator app or a security key if offered. A code by text message is weaker, but much better than nothing.
3. Save the backup codes in your password manager or on paper, somewhere safe, in case you lose your phone.

Checklist

• Check your important passwords with the leaked password check.
• Any password that appears: change it everywhere, email and bank first.
• One different password per site, saved in a password manager.
• Long passphrases of random words for the few you type by hand.
• Two-step verification on your email and bank.
• Change passwords by typing the address yourself, not from links in messages.

Frequently asked questions

Is it safe to type my real password into the checker?

Yes. Your browser hashes it and sends only the first 5 of the hash's 40 characters to Have I Been Pwned. The password and the full hash stay on your device, and the comparison happens there.

My password was not found. Does that mean it is strong?

No. It only means it is not in the breach lists Have I Been Pwned knows about. A short or predictable password can still be guessed quickly, and a breach that has not been made public yet would not show up.

My password appears, but my account was never hacked. Why?

The check looks at the password, not your account. Someone else may have used the same password, especially if it is common. Either way it is now in the lists attackers use, so stop using it.

Should I change all my passwords every few months?

Not if they are long, unique and not leaked. NIST advises against forced periodic changes, because people end up making small, predictable edits. Change a password when there is a reason: a breach, a check that finds it, or signs of someone else in your account.

Try it

• 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
• 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.