Your email address has probably already been in a breach. Two minutes is all you need to check, and to know what to do.
You hear about a breach at LinkedIn, Adobe, LastPass, an old site you'd forgotten... Nobody tells you on their own. You have to go look.
One simple, free, serious tool exists for exactly that: Have I Been Pwned (HIBP). Governments, Mozilla, 1Password and many security services rely on it.
Do it now (2 minutes)
- Go to haveibeenpwned.com
- Enter your main email address
- The page tells you whether it appears in any breach, and which ones
HIBP is a search tool, not a vacuum cleaner: it doesn't store or share your address. It compares against a public database of known breaches.
Run it again for your other addresses (personal, work, an old Hotmail from the 2000s).
What you'll probably see
If your address is more than five years old, it will show up in several leaks. Not a disaster: it usually means a site you no longer use was compromised. What matters is what you do next.
| Situation | Action |
|---|---|
| An old, forgotten site | Make sure the password isn't reused elsewhere |
| An active service (Netflix, Amazon...) | Change the password, turn on MFA |
| A password that shows up in a breach | Change it everywhere, right now |
| Nothing found | Turn on alerts anyway |
HIBP also lets you check a password: go to "Passwords" and paste one you suspect is compromised. The comparison is done locally so your password is never sent in the clear (k-anonymity).
Turn on alerts, once
On HIBP, click "Notify me". You'll get an email next time your address appears in a new leak. Free, quiet, useful.
What to do, in order
Check your two or three main addresses first, turn on alerts for each, then list every site where an old compromised password is still in use. Prioritize the cleanup in this order: main email, bank, government portals, social media, then the rest. The rest can wait for the next coffee. The real urgency is in the first four.
After a leak, the right answer is almost always the same: change the password and turn on MFA. A password manager runs these checks continuously and alerts you live. For the broader context, is our data safe with AI?.