Breached email addresses and passwords are used to write convincing scam messages and to break into other accounts that share the same password. This guide shows how to check whether your details appear in known breaches, using Have I Been Pwned and the password checks built into Chrome and Apple’s Passwords app, and what the UK’s National Cyber Security Centre (NCSC) recommends doing next.

1. Search your email address

Have I Been Pwned (HIBP) is a free service that gathers data from breaches so people can see where their details were exposed. Its public search takes one email address or username at a time and returns the breaches it appears in. The service’s FAQ says nothing is explicitly logged by the website beyond analytics and performance monitoring, and searches travel over an encrypted connection.

Some breaches are classed as “sensitive” because being found in them could harm a person, and these do not appear in public searches. HIBP currently counts 90 of them. To see them, sign in to the HIBP dashboard, which checks that you can receive email at the address; all breaches then appear in the “Breaches” section under “Personal.” To hear about future breaches, sign up for the site’s Notify Me service, which the FAQ says stores only the email address, the date you subscribed and a random verification token.

2. Check a password without sending it

HIBP’s Pwned Passwords page checks whether a password has appeared in a breach. According to the page, the password is hashed on your device and only the first five characters of its SHA-1 hash are sent; the service returns matching results and the final comparison happens on your side. If a password is found, HIBP says it should never be used and should be changed wherever you have used it. A clean result does not necessarily mean the password is a good one, only that it is not in HIBP’s index.

3. Run your password manager’s check

Chrome

  1. Open Chrome, select More at the top right, then Passwords and autofill, then Google Password Manager.
  2. On the left, select Checkup. Google’s Chrome help page says you will get details on any saved password exposed in a data breach and any weak, easy-to-guess passwords.
  3. For future alerts, select More > Settings > Privacy and security, then Security > Standard protection, and turn on Warn you if a password was compromised in a data breach.

Google says Chrome may also show the alert “Your password was found in a public data breach” when you sign in on compatible websites, with a Change it for me option if you are signed in to your Google Account in Chrome and have password saving turned on.

iPhone Passwords app

  1. Open the Passwords app and tap Security. Apple’s iPhone User Guide says an account with a weak or compromised password shows a message explaining the problem.
  2. Tap the account, then tap Change Password and change it on the website or in the app. Apple suggests moving to a passkey or Sign in with Apple where the site offers it.
  3. To keep monitoring on, go to Settings, tap Apps, tap Passwords and turn on Detect Compromised Passwords.

4. What to do if you were exposed

The NCSC’s guidance for individuals and families sets out these steps:

  1. Find out whether you were affected by contacting the organization through its official website or social media channels. Do not use links or contact details from messages you were sent.
  2. If you still use the leaked password, change it as soon as you can, and change it on any other account that uses the same password. Where available, the NCSC suggests a passkey instead.
  3. Check your accounts for unauthorized activity: being unable to log in, changed security settings, messages sent from your account that you do not recognize, and logins from strange locations or at unusual times.
  4. Watch for scam messages, which may arrive some time after a breach is made public. Official-sounding messages about resetting passwords or receiving compensation, and pressure to act immediately, are warning signs. The NCSC says your bank will never ask you to supply personal information.
  5. If you have lost money, tell your bank. In the UK, the NCSC says to report it to Report Fraud and to forward suspicious texts to 7726.

Common problems

  • A breach lists a site you never joined. HIBP says this can happen because your data was acquired by another service, the service rebranded, or someone else signed you up.
  • The breach is still listed after you changed the password. HIBP keeps a record of breaches an address appeared in regardless of later password changes.
  • You cannot set up alerts for an old address. HIBP sends notifications only to the address being monitored, so an address you no longer control cannot be monitored.
  • Chrome’s breach warning will not turn on. Google says the feature is only available when Safe Browsing is on.
  • Your iPhone flags a site that no longer exists. Apple says to open Passwords, tap All and swipe left on the account to remove it. If you cannot fix a warning, tap the account under Security and tap Hide.

Corrections and tips: email the editor using the address on the Contact page.