Has Your Email Been Breached? Here's How to Actually Check
Data breaches happen constantly, and most companies are slow, or quiet, about telling you. The good news is you don't need to wait on them: a free tool checks your email against a database of billions of breached records in seconds. This guide walks through exactly how to check, what a match means, and what to actually do about it once you find one.
Have I Been Pwned lets anyone check an email address against known data breaches for free, with no signup required.
Use Have I Been Pwned — It's Free and Takes Seconds
Have I Been Pwned (HIBP) is a free service, built and run by security researcher Troy Hunt, that aggregates data from confirmed breaches and lets anyone search whether their email address appears in one. It doesn't store or expose passwords next to your email in search results, and searching your own address costs nothing and requires no account.
Here's what a search actually shows you: which specific breaches your address turned up in, roughly when each breach happened, and what kind of data was exposed in each one, passwords, phone numbers, physical addresses, and so on, depending on what the breached company actually lost.
Step by Step
Go to haveibeenpwned.com
Enter your email address in the search box on the homepage and click the search button. No signup, no email verification needed just to run the search.
Read the result
A green result means your address wasn't found in any indexed breach. A red result lists every breach it was found in, with a short description of what data each one exposed.
Check for sensitive breaches separately
Some breaches are classed "sensitive," dating sites and similar services, and aren't shown in a public search to protect people from exposure. To see those, you have to verify you own the email address by signing into HIBP's dashboard.
Turn on free breach notifications
Sign up at haveibeenpwned.com/NotifyMe and you'll get an email automatically any time your address shows up in a newly indexed breach going forward, rather than having to remember to check again.
Don't Panic — But Do Act
A match doesn't mean your account was necessarily broken into. It means your email address, and whatever other data the breach exposed, was present in a dataset that leaked or was stolen. If your password was one of the exposed fields, though, treat that account and any other account using the same password as compromised, because credential-stuffing attacks, trying leaked username/password pairs against other sites, are exactly how a lot of real account takeovers happen.
A password manager and two-factor authentication together close off the most common way breach data turns into a real account takeover.
What to Actually Do Next
Change the exposed password
Update the password on the breached account immediately, and on any other account where you reused that same password.
Use a password manager
A password manager generates and stores a unique password per site, so one breach can't cascade into every account you have.
Turn on two-factor authentication
2FA adds a second checkpoint that a leaked password alone can't get past, on every account that offers it, especially email and banking.
Watch for follow-up phishing
Breach data often gets used to craft convincing phishing emails referencing real details about you. Be extra cautious with unexpected emails for a while after a breach notification.
Bottom Line
Checking whether your email has been breached costs nothing and takes under a minute, so there's little reason not to do it, and setting up free ongoing alerts means you'll find out automatically the next time it happens rather than stumbling onto it months later. A match isn't cause for panic, but it is a clear, specific signal about which passwords need changing right now. Do that, turn on two-factor authentication where you haven't already, and you've closed off the most common way breach data actually gets turned into a real account takeover.
More AI Guides, Written Clearly
Browse our full library of AI tool guides, updated regularly as models and features change.
Common Questions
How do I check if my email was in a data breach?
Go to haveibeenpwned.com, enter your email address, and search. It's free, requires no signup, and instantly shows which known breaches, if any, your address appeared in.
Is Have I Been Pwned safe to use?
Yes. It's a well-established, widely trusted security tool built by security researcher Troy Hunt. Searching an email address doesn't store or expose it, and it doesn't require creating an account.
What should I do if my email shows up in a breach?
Change the password on the affected account and any other account using the same password, enable two-factor authentication where available, and watch for follow-up phishing attempts using details from the breach.
Can I get notified automatically about future breaches?
Yes. Have I Been Pwned offers a free notification service at haveibeenpwned.com/NotifyMe that emails you automatically whenever your address appears in a newly indexed breach.
More from the creator
Explore two other projects from the same creator.