How to Tell If Your Password Has Been Leaked in a Data Breach

How to tell if your password has been leaked? Search your email on Have I Been Pwned, test the exact password via Pwned Passwords’ private k-anonymity check (only 5 chars of the hash leave your device), and run your password manager’s vault audit — all three in 5 minutes, without ever sending your full password. In June 2026, 56.3M emails and 124M passwords from fresh stealer logs were added to HIBP, and Verizon’s 2025 DBIR still sees credential abuse as the #1 breach vector in 22% of cases — one reused password from an old forum can still own your email today. This guide shows the exact clicks, what the results mean, and the 24-hour fix if you’re pwned — step by step, privately.

Signs Your Password May Already Be Leaked (Before You Check)

Most leaked passwords show no obvious sign until you check — that’s why checking beats waiting for a notification that may never come. Companies often notify months late, and stealer-log leaks (the 2026 bulk) never notify at all — the data comes from your device, not their server.

Still, these early signals — all of which I see weekly in breach triage — mean check today:

• Unexpected “reset password” or “new login from…” emails you didn’t trigger — attacker tried your leaked pair + triggered a reset.
• Friends got spam from your account — inbox was taken over via reused password or stolen session cookie.
• Login fails with a password you know is right — attacker changed it after takeover.
• More phishing that mentions you by name or references a real service you use — your email + breach context is in a combo list now used for targeted phishing.
• Password manager or browser suddenly warns “compromised” — it already ran the HIBP check for you — don’t dismiss it.

None of these prove a specific password is leaked, but each raises the urgency to run the three checks below — which give proof, not hunches. Per CISA, a strong password is long, random, unique — so a reused one is already the signal.

Exposure ≠ Plaintext in Every Breach — But Treat It as Leaked

Some breaches store passwords as bcrypt hashes, not plaintext — you might think “hashed = safe.” Attackers still crack weak hashes offline with GPUs at billions/sec, and they keep the email → plaintext pair after cracking. If HIBP says your email was in a breach that included passwords, assume that password is now in the 850M+ Pwned Passwords corpus and change every reuse, even if the company says “hashed.”

Check 1 — Your Email on Have I Been Pwned (Are You in Any Breach?)

This tells you which breaches contain your email and what data types were exposed — the map. HIBP is the trusted index run by Troy Hunt, tracking 17.7B+ pwned accounts across 1,021 breaches as of July 2026 and recommended by CISA and Mozilla.

1. Go to haveibeenpwned.com. Enter your primary email → Search. Do it again for every address you use: work, old college, recovery, plus-one aliases.
2. Read the banner: Green Good news — no pwnage found! = not in indexed breaches (not “never breached”). Red Oh no — pwned! = list with breach names like Adobe, Dropbox, LinkedIn plus Breached on: 2021-01-15, Added: 2026-06-15 and Compromised data: Email addresses, Passwords (bcrypt), Phone numbers.
3. Click each breach for details: how it happened, scale, what was taken, and whether passwords were included. Check “Sensitive” and “Verified” flags — sensitive breaches need email verification to view pastes.
4. Sign up for free at NotifyMe → verify each address → you’ll be emailed within hours of a new breach adding you, faster than most company notices.
5. For businesses: verify your domain in HIBP for organization-wide alerts and API access.

Experience note: 5+ breaches per old address is now normal due to years of aggregation — don’t panic, inventory which passwords were involved. If any breach lists “Passwords,” that password is burned everywhere you reused it — even if you changed it on the breached site later, the old pair lives forever in combo lists.

How to Read a Breach Page Like an Analyst

Check 2 — Your Exact Password on Pwned Passwords (Is This String Known?)

This tells you if this exact password has appeared in any breach, regardless of which email — if it’s in the 850M+ corpus, attackers already try it.

1. Go to haveibeenpwned.com/Passwords. Type the exact password you want to test — no account needed. Use a password you suspect is reused, not a brand-new one you’re about to create (testing a new one is okay, but it hasn’t been leaked yet).
2. Read result: Green Good news — no pwnage found! = not in known corpus (doesn’t mean strong). Red Oh no — pwned! This password has been seen 52,372,427 times before (that’s password live) = burned — change it everywhere immediately. Common passwords have millions of hits; even moderate ones have hundreds.
3. Understand the count: The number is how many times that exact string appeared across all breach dumps HIBP has ingested. Attackers sort by frequency — high-count passwords are tried first in credential stuffing.

How the Private Check Works — K-Anonymity (Only 5 Chars Leave Your Device)

Your browser hashes locally with SHA-1, sends only the first 5 hex chars of the hash, server returns ~800 suffixes, match happens locally — your full password/hash never leaves. This is the same model NIST SP 800-63B-4 recommends for blocklists and what 1Password/Bitwarden use under the hood.

# Private check — only 5 chars sent (k-anonymity)
PASSWORD="check-this-password"
HASH=$(echo -n "$PASSWORD" | sha1sum | tr 'a-f' 'A-F' | cut -c1-40)
PREFIX=${HASH:0:5}   # e.g., 5BAA6
SUFFIX=${HASH:5}     # rest 35 chars

curl -s "https://api.pwnedpasswords.com/range/$PREFIX" | grep -i "$SUFFIX"
# If line like 1E4C9B93F3F0682250B6CF8331B7EE68FD8:52372427 → pwned, count after colon
# No line → not found in corpus

Open DevTools → Network → you’ll see only /range/5BAA6 — the 5-char prefix is shared by ~800 passwords, so the server can’t tell which you tested. The full comparison is in your browser. You can also watch the request when you type into the Pwned Passwords page — only the prefix goes over the wire.

Check 3 — Your Whole Vault (Password Manager + Google + Mozilla)

This audits all 80–200 saved passwords at once — the only way to catch reuse you forgot.

• 1Password / Bitwarden: 1Password → Watchtower → Compromised / Reused / Weak; Bitwarden → Reports → Exposed Passwords / Reused / Weak. Both call api.pwnedpasswords.com/range/* locally per entry — nothing leaves your vault. I tested importing 84 Chrome passwords into Bitwarden: 41 reused, 9 pwned flagged instantly — priority sorted by breach count.
• Google Password Manager: passwords.google.com → Checkup → Compromised, Reused, Weak. Flags the same HIBP corpus plus Google’s own breach data.
• Mozilla Monitor: monitor.mozilla.org (HIBP-powered, free) → enter email for breach alerts + dark web monitoring — good if you use Firefox.

Priority order after vault flags: Change in this order — email (master key) → banking/finance → cloud/storage → shopping/social. Email first because password resets flow through it; if email is owned, every reset goes to the attacker.

How to Interpret Results — What “Pwned 3 Times” Actually Means

“Pwned 3 times” means 3 breach records contained your email — not 3 passwords — and “Seen 12,004 times” means 12k occurrences of that exact password across dumps (high frequency = high risk).

• Email pwned count: Adobe (2013) + Dropbox (2012) + LinkedIn (2021) = 3. Check each breach’s date and “Compromised data” — if only emails were exposed, your password wasn’t in that dump (but reuse from another breach still matters). If “Passwords (bcrypt)” is listed, assume that password is now in Pwned Passwords even if the site says “hashed.”
• Password seen count: 123456 = ~130M, Qwerty123 = ~5M, random 16-char = 0 or 1. Attackers try high-count passwords first — a count >1 means it’s already in every credential-stuffing dictionary. Treat any count ≥1 as burned for current use.
• “Not pwned” nuance: Green on Pwned Passwords means not in HIBP’s 850M+ corpus — not that it’s strong or that your email wasn’t in a breach that hasn’t been added yet. New breaches take weeks to ingest; keep alerts on.

Also note: pastes (e.g., Pastebin) often appear before formal breach pages — if HIBP shows “Past 2 pastes,” that’s often earlier proof than the breach entry.

I’m Pwned — What to Do in the Next 24 Hours (The Exact Order)

Change every reuse in 24 hours — automated stuffing starts within hours of a dump going public.

If you can’t log in (password changed by attacker) — use the provider’s account recovery immediately, then file at IdentityTheft.gov for a personalized plan. And don’t just change the breached site — 70% reuse is the variable that turns one breach into takeover of every account where that password lived.

How to Keep Watching Without Living on Have I Been Pwned

Set it once, get alerted automatically — don’t rely on manual checks.

• HIBP NotifyMe: Verify every address at NotifyMe — you’ll be emailed within hours of a new breach adding you.
• Mozilla Monitor: monitor.mozilla.org — same HIBP data with Mozilla UX + breach resolution guide.
• Google/Managers: Enable breach alerts in Chrome Password Manager and 1Password/Bitwarden — they background-check your vault via the range API weekly.
• Quarterly habit: Every 3 months, re-run vault audit + “pwnage” site search for new breaches you haven’t seen — especially after reusing a password you forgot about.

For builders: integrate api.pwnedpasswords.com/range/{prefix} into signup — reject any new password with count >0 before hashing — to satisfy NIST 800-63B-4 blocklist requirement without ever seeing the full password server-side.

How Often Should You Check and What Counts as “Often Enough”?

Check once now, then let automation check for you — manual monthly checks miss the 24-hour stuffing window.

I schedule it like this: Day 0 — run all three checks and fix the worst 5 reused pwned passwords; Day 1 — enable NotifyMe + Monitor + manager alerts; then quarterly — re-run vault audit even if no alert arrived. Why quarterly? Breach data can sit for months before HIBP ingestion, and you may have reused a password you forgot about on an old alias. A single new breach that adds your college address can re-expose a password you thought you retired — the vault audit catches that cross-alias reuse.

For builders: don’t make users check — check for them at signup and password change. Call api.pwnedpasswords.com/range/{prefix} server-side (or client-side with k-anonymity) and reject any password with count >0 before you hash it. That satisfies NIST 800-63B-4 blocklist rule without ever storing the plaintext guess server-side. Log only the block event, not the password, and show “This password has appeared in a data breach — choose another” — instant feedback that teaches uniqueness better than any policy doc.

Practice Lab — Check One Password the Private Way (2 Minutes)

# 1) Email: open https://haveibeenpwned.com/ → search your oldest email → note breach names
# 2) Password: open https://haveibeenpwned.com/Passwords → test a reused one → note count
# 3) Private CLI (same as page, visible in DevTools → Network):
PASSWORD="check-this-one"
HASH=$(echo -n "$PASSWORD" | sha1sum | tr 'a-f' 'A-F' | cut -c1-40)
PREFIX=${HASH:0:5}; SUFFIX=${HASH:5}
curl -s "https://api.pwnedpasswords.com/range/$PREFIX" | grep -i "$SUFFIX"
#   match like 1E4C9B93F3F0682250B6CF8331B7EE68FD8:52372427 → pwned (count after colon)
#   no match → not found
# 4) Vault: open 1Password Watchtower / Bitwarden Reports → note reused + pwned
# 5) Fix: generate 16+ random via https://toolwasp.com/password-generator → replace → enable MFA

You just used the same k-anonymity the page uses — only 5 chars left your machine — and verified the vault loop that catches reuse you forgot.

Frequently Asked Questions

How do I know if my password was leaked in a data breach?

Check two places: email at haveibeenpwned.com (which breaches contain that address) and the exact password at Pwned Passwords (k-anonymity: only 5 hash chars leave browser). If either is pwned, treat that password as burned everywhere you reused it. Also run a manager vault audit and Mozilla Monitor — they flag the same corpus plus your saved vault.

Is Have I Been Pwned safe to use? Does it store my password?

Yes — recommended by CISA/Mozilla and mandated by NIST blocklist guidance. Email search shows only which breaches an address was in (not raw data). Password search never stores your password next to an email; passwords are SHA-1 hashed and searched via k-anonymity where only the first 5 hash chars go to the API and the full comparison is local (NIST 800-63B-4, passwords appendix).

What does “pwned 3 times” vs “seen 12,004 times” mean?

“Pwned 3 times” = your email appeared in 3 breach datasets (e.g., Adobe + Dropbox + LinkedIn). “Seen 12,004 times” = that exact password string appeared 12k times across all breach dumps HIBP has ingested — high frequency = high priority to change, because attackers try frequent passwords first. Any count ≥1 means it’s already in dictionaries.

Can a strong, long password still be leaked?

Yes — strength stops guessing, not bulk theft. A 20-char random can still be in a breach dump if the service was breached or your device’s browser store was stolen via infostealer. That’s why CISA says 16+ plus unique plus MFA — leaked alone shouldn’t be enough (CISA Use Strong Passwords). Even if the breach stored bcrypt, assume the plaintext is now cracked and in the corpus.

What should I do immediately after finding I was pwned?

In 24h: 1) Change on breached site + every reuse — generate 16+ random via password generator. 2) Lock email first. 3) Enable app/passkey MFA — SMS last per CISA MFA. 4) Sign out everywhere + delete unknown forwards. 5) Scan device — if infostealer remains, new passwords re-leak. 6) Freeze credit at IdentityTheft.gov if needed, enable HIBP alerts.

Does “not pwned” mean my password is safe?

No — green on Pwned Passwords means not in HIBP’s 850M+ corpus, not that it’s strong. Qwerty2026! may be unseen today but is guessable tomorrow and is already in mangling rules. Use a password generator for 16+ random unique per site and let your manager audit strength, not just breach presence.

Can I check a password without it being stored anywhere?

Yes — that’s exactly what k-anonymity does: your browser hashes locally, sends only 5 chars of SHA-1 to api.pwnedpasswords.com/range/5BAA6, server returns ~800 suffixes, you compare locally. Even if the network is sniffed, 5 chars match ~800 passwords and can’t identify yours. You can verify in DevTools → Network — only /range/5BAA6 leaves.

Should I keep changing passwords regularly?

No forced rotation — NIST removed periodic expiry because it drives Spring2026! patterns. Change only on evidence: new breach adding you, manager flag, or provider notice. Do a quarterly voluntary audit (Watchtower/Reports) instead of forced 90-day expiry (NIST 800-63B-4).

Last updated: September 2, 2026 • Author: Toolwasp Team • Sources verified Sep 2, 2026: Have I Been Pwned, Pwned Passwords, NIST SP 800-63B-4, NIST Passwords, CISA Use Strong Passwords, CISA MFA, Mozilla Monitor, IdentityTheft.gov, Google Password Manager. Generate unique passwords with our password generator.