How to Check If Your Email Was in a Data Breach with Have I Been Pwned

When a site you signed up to is breached, your email address, username and sometimes your password start circulating online, often without you ever hearing about it. Have I Been Pwned is a free service that makes addresses collected from known breaches searchable and shows in seconds which breaches your email appears in.

The result tells you which accounts need a new password right away. The same site also lets you check whether a password has already been exposed, without sending the password in the clear.

1. Open the site at the right address Type haveibeenpwned.com into your browser's address bar; do not follow links in emails or messages warning you about a breach. The search box titled "Check if your email address is in a data breach" appears straight away on the home page. You do not need an account to search for an email address.
2. Search for your email address Type your email address into the search box and press Check. Only one address or username can be searched at a time. If you have several addresses, check each one separately, and do not skip old addresses you have used for years.
3. Read the result "Good news — no pwnage found!" means the address was not found in any of the breaches loaded into the site. "Oh no — pwned!" means every breach containing your address is listed under Data Breaches below. If a Paste Records section appears, your address was also found on public text-sharing sites.
4. See what was exposed Click the name of a breach in the list to open its detail page. The Compromised Data section shows what was exposed in that breach, such as email addresses, usernames, passwords, phone numbers or dates of birth. Treat breaches that list Passwords as the priority; change the password even if it was stored encrypted.
5. Change passwords and turn on two-step verification Change your password on the breached site right away. If you used the same password elsewhere, change it on those accounts one by one; attackers automatically try leaked email and password pairs on other sites. Start with your email account, because password reset links for your other accounts go there. Turn on two-step verification on every account that supports it.
6. Test your password with Pwned Passwords Go to the Passwords page from the top menu, type the password into the "Password to check" box and press Check. The site states that the password is anonymised before it is sent and that passwords are not stored alongside any personal data. If you see "Oh no - pwned!" with the number of times it has been seen, never use that password anywhere. A clean result does not make a password strong; it only means it is not in the site's lists.
7. Sign in to the dashboard for sensitive breaches Some breaches are classed as "sensitive" because simply being a member of that site could harm someone, so they are not shown in public searches. To see them, enter your email on the Dashboard page, request a sign-in link with Sign In and click the link in the email you receive. Once signed in, all breaches, including sensitive ones, are listed in the Breaches section under Personal.
8. Turn on alerts for new breaches Open the Notify Me page from the menu, enter your email address, tick the box proving you are not a bot and press Notify Me. Click the verification link sent to your inbox to finish signing up. From then on you will be told if your address appears in a new breach. Emails come from [email protected]; check your spam folder if you do not see them.

⚠ This guide is general information. Yudum cannot be held responsible for the outcome of following it; for official procedures always rely on the institution's own statement. Steps and fees change over time.

🎯 Related content

How do you download and delete your data with Google Takeout? From photos to email, from location history to searches — what's in your account? Download it all, and have what you don't need deleted automatically. What should you do if your social media account is hacked? The first ten minutes are when getting the account back is easiest. In order: recovery, closing sessions, protecting linked accounts, warning the… Where do you report internet fraud? If you've lost money, the first hours are critical. Which incident goes to which institution, and which evidence you need to gather — in order. How do you turn on two-step verification? Keep your account out of reach even if your password is stolen: two-step verification is the single setting that, on its own, makes the biggest… How to spot a scam message A parcel, a bank, e-Devlet, a prize draw... Fake messages all use the same patterns. Once you have learned those patterns, you don't fall for them… What to do if you forget your password No panic. If you gave an e-mail address it is a five-minute job — if you didn't, there is a section you need to read.