How to check if your accounts were in a breach

I run a handful of privacy and infrastructure sites out of Singapore, and every few months I get the same message from a reader or a friend: “someone logged into my account from a country I’ve never been to, am I hacked?” Nine times out of ten the answer traces back to a credential stuffing attack built on an old data breach, sometimes one that’s years old. The password they reused on three other sites in 2021 finally got matched to their email in a leaked database, and now it’s being tried everywhere.

This tutorial is for anyone who wants a straight answer to “was I in a breach” without installing sketchy browser extensions or handing their email to a random site that promises to “scan the dark web.” I’ll walk through the legitimate, free-to-use tools that security researchers and companies actually rely on, how to check both your email addresses and your passwords, and what to do once you find something. This is aimed at individuals managing a handful of personal accounts, but I’ll also cover what changes if you’re checking this for a family or a small team.

By the end you’ll have checked every email address you use against known breach databases, checked whether any of your current passwords have shown up in a leak, and set up ongoing monitoring so you find out about the next breach in hours, not years.

what you need

A web browser, or curl/PowerShell if you want to script the checks
The email addresses you actually use for logins (not just your primary one)
15-30 minutes for the first pass
A password manager already installed, or willingness to install one (1Password, Bitwarden, or the one built into your browser all work)
No cost for the core checks. Have I Been Pwned and Mozilla Monitor are both free for individual lookups
Optional: an HIBP API key (currently paid, tiered starting around $4.50/month depending on the plan at haveibeenpwned.com/API/v3) if you want to automate checks across many addresses

step by step

Before you check anything, write down every address you’ve used, not just the one you check email on daily. I have four: a personal Gmail, a work address, an old Hotmail from 2009 I still use for forums, and a catch-all address on my own domain. Old, half-forgotten addresses are exactly the ones that show up in old breaches.

Expected output: a plain list of 2-6 email addresses.

If it breaks: if you genuinely can’t remember old addresses, check your password manager’s saved logins or your browser’s autofill list. Most people have more accounts than they think.

2. check each address on Have I Been Pwned

Go to haveibeenpwned.com and enter one email address at a time in the search box. This is the tool built and maintained by security researcher Troy Hunt, and it’s the one journalists and security teams cite by default when a breach makes news. It aggregates hundreds of breach datasets and tells you which ones included your address, plus what kind of data was exposed in each one (passwords, physical addresses, phone numbers, etc.).

Expected output: either “Good news, no pwnage found” or a red list of named breaches (e.g. “LinkedIn, 2012”, “Adobe, 2013”) with a description of what data each one leaked.

If it breaks: if the site times out or is slow, it’s usually load right after a big breach makes headlines. Wait a few minutes and retry, or use the Firefox-integrated version at Mozilla Monitor below, which pulls from the same underlying dataset.

3. cross-check with Mozilla Monitor

Mozilla Monitor (formerly Firefox Monitor) runs on the same HIBP breach data but presents it differently and lets you set up a free account to track multiple addresses in one dashboard, without needing an API key. I use this as a second source mainly because it emails you automatically when a new breach includes one of your saved addresses, which HIBP’s free tier doesn’t do per-address unless you use their separate notification signup.

Expected output: a dashboard showing each monitored email and any breaches tied to it, plus a subscription for future alerts.

If it breaks: if you don’t get a confirmation email after signing up, check spam first. Mozilla accounts occasionally get flagged by aggressive corporate spam filters because of the volume of automated breach-notification mail they send.

4. check whether your actual passwords have leaked, not just your email

Finding out your email was in a breach doesn’t tell you if your current password is compromised. For that, use the Pwned Passwords tool, which works on a k-anonymity model so your actual password is never sent anywhere. Your password gets hashed with SHA-1 locally, only the first 5 characters of the hash are sent to the API, and it returns all matching hash suffixes for you to compare locally.

# hash your password locally, never send the plaintext anywhere
echo -n "yourpassword" | sha1sum
# take the first 5 characters of the hash and query the range API
curl -s "https://api.pwnedpasswords.com/range/5BAA6"

If your full hash’s remaining characters appear in the returned list, that exact password has appeared in a known breach corpus. Most password managers (1Password’s Watchtower, Bitwarden’s Data Breach Report) run this check automatically against your entire vault, which is the easier path for most people.

Expected output: either no match (password hasn’t been seen in the corpus) or a count of how many times that exact password has appeared across breaches.

If it breaks: don’t paste your real password into a random website that asks for it directly, even if it claims to be doing “the same check.” The k-anonymity range API is the only version where you’re not exposing the plaintext. If a tool asks you to type your actual password into a form field to “check” it, that’s a red flag, not a shortcut.

5. run your password manager’s built-in breach report

If you use 1Password, open Watchtower and look at “Compromised Passwords.” If you use Bitwarden, the same feature lives under Tools > Data Breach Report on the web vault. Both check your saved logins against the same Pwned Passwords dataset described above, automatically, for every saved credential.

Expected output: a list of saved logins flagged as reused, weak, or found in a breach corpus.

If it breaks: if your vault shows zero flagged items but you know you’ve reused passwords, make sure the manager is actually storing the login (some browser-saved passwords never get imported into the manager’s vault and get missed).

6. change any password flagged as compromised, starting with high-value accounts

Prioritize email, banking, and anything tied to your identity (government portals, primary cloud storage) first. Generate a new, unique password with your manager’s generator, don’t reuse a variant of the old one.

Expected output: each flagged account now has a unique, generated password stored in your manager.

If it breaks: if you can’t log in to change the password because the account was already taken over, use the site’s account recovery flow immediately and check for unauthorized email forwarding rules or added recovery phone numbers, both common signs of takeover.

7. turn on two-factor authentication on anything you just fixed

A breached password with 2FA enabled is a much smaller problem than one without it. Use an authenticator app (Authy, or your password manager’s built-in TOTP) rather than SMS where the option exists, since SIM-swap attacks target SMS codes specifically. NIST’s digital identity guidelines (SP 800-63B) explicitly deprioritize SMS as an authentication factor for this reason, see NIST SP 800-63B.

Expected output: 2FA enabled and confirmed with a working test login.

If it breaks: if the site only offers SMS 2FA, it’s still better than nothing, but move your recovery email and phone number verification to something not tied to a SIM you don’t control if you can.

8. set up ongoing monitoring so you’re not doing this manually every time

Subscribe your addresses to Mozilla Monitor’s notification list (step 3) and, if you manage your own domain, consider HIBP’s domain search feature, which lets you verify ownership of a domain and get notified about any address @yourdomain.com that shows up in a future breach.

Expected output: an email alert the next time any of your monitored addresses appears in a new breach, usually within days of the breach becoming public.

If it breaks: domain verification for HIBP requires adding a DNS TXT record. If verification fails, check that you’re editing the DNS zone for the exact domain (not a subdomain) and give propagation 15-30 minutes before retrying.

common pitfalls

Only checking your main email. Old forum accounts and long-abandoned addresses are disproportionately represented in breach dumps because those sites had worse security in the first place.
Reusing a “fixed” password as a slight variant of the old one. If Summer2023! leaked, Summer2024! will get caught by credential stuffing tools within days. Generate something unrelated.
Panicking and changing everything at once without checking what’s actually flagged. Prioritize based on the report, not fear. Changing 40 passwords in an afternoon usually means you write them down somewhere insecure.
Trusting “dark web scan” services that ask for your password directly. Legitimate breach checks never need your plaintext password, only a hash or your email address.
Assuming 2FA fixes everything. 2FA protects against reused passwords being used to log in elsewhere, it doesn’t undo damage if the breach also exposed your physical address, phone number, or security questions.

scaling this

For one person (a handful of accounts), the manual steps above take 20 minutes and you’re done. Once you’re checking accounts for a family, say 4-6 people, the smart move is a shared password manager plan (1Password Families, Bitwarden Families) so everyone’s vault gets Watchtower-style checks automatically instead of you manually running each person’s email through HIBP one at a time.

At the scale of a small team or business (dozens of employee accounts), manual per-address checks stop being practical. This is where HIBP’s domain search and paid API become worth it: verify your company domain once, and you get notified automatically whenever any @yourcompany.com address appears in a new breach, without anyone having to remember to check. Pair this with an enterprise password manager (1Password Business, Bitwarden Business) so breach monitoring runs centrally against every employee vault.

Beyond a few hundred accounts, you’re really talking about enterprise identity infrastructure, not a manual how-to. At that point the checks get folded into your identity provider (Okta, Azure AD) via compromised-credential detection features, and HIBP’s API gets called programmatically as part of onboarding or periodic access reviews rather than as a one-off lookup. The underlying tools stay the same, what changes is whether a human is running the check or a script is.

where to go next

If step 6 above left you juggling a dozen new passwords, read our breakdown of password managers worth paying for in 2026 before you pick one at random. If you want to lock down the accounts you just secured, our guide to setting up two-factor authentication properly covers authenticator apps versus SMS in more depth than step 7 above. And if your threat model goes beyond “was I in a breach” into wanting to browse without being tracked or fingerprinted across sessions, the folks at antidetectreview.org cover browser isolation and fingerprint resistance in more depth than we do here. For everything else we’ve published, start at our blog index.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-07-18.