How to check if your data was breached: 5 free tools

Key takeaways

• Have I Been Pwned is the quickest free way to check if your email address appeared in a known data breach; it listed 1,047 breached websites as of 26 October 2026.
• To test a password without revealing it, use Pwned Passwords, Google Password Checkup or the Security section of Apple's Passwords app. All three compare hashed data, not your plain password.
• A hit does not mean an account has been taken over. It means data tied to you is circulating, so act on it in order: change reused passwords, add passkeys or two-factor authentication, then protect your credit and inbox.
• In the US, a credit freeze is free at Equifax, Experian and TransUnion and does not affect your credit score, according to the Federal Trade Commission.

Here is how to check if your data was breached: run a free email lookup on Have I Been Pwned, then scan your passwords with Pwned Passwords, Google Password Checkup or Apple's Passwords app. On 26 October 2026 the site listed 1,047 breached websites.

Each check takes about two minutes, and what you do next matters more than the result. This week alone, Bullquill reported on the Capcom ID breach affecting 11.7 million records, the Quest Diagnostics Quanum breach of patient records and the State Bank of India cyberattack. Notices like these usually say what kind of data was taken, but not whether your record was in it. The tools below close that gap.

How to check if your data was breached: the 5 free tools

Each tool answers a slightly different question. Two check your email address and three check your passwords. Use at least one of each.

Data as of 26 October 2026 UTC. Sources: Have I Been Pwned FAQ and API documentation, Google Account Help, Google Security Blog, Apple Support, Apple Platform Security guide, Mozilla Support.

Step 1: Search your email on Have I Been Pwned

Have I Been Pwned (HIBP) collects data from breaches so people can see where their details were exposed. Go to haveibeenpwned.com, type an email address and press the check button. The results list every breach that address appears in, with the breach date and the types of data involved, such as email addresses, passwords, phone numbers or dates of birth.

Three details make the results more useful:

• Sensitive breaches are hidden from public search. The HIBP FAQ says 89 breaches are flagged as sensitive. You only see them after confirming that you control the inbox, by signing in to the dashboard.
• Turn on alerts. The "Notify me" service emails you if the address turns up in a future breach. Notifications go only to the address being monitored, so nobody can watch someone else's email.
• Check every address you use. Old addresses from school, work or a past provider often appear in older breaches and may still be the recovery address for live accounts.

HIBP does not store breached passwords next to email addresses and never sends a password back to you, according to its FAQ. That is why a "pwned" result tells you where the leak happened, not which password leaked.

Step 2: Test a password with Pwned Passwords

The Pwned Passwords page checks a single password against breached password lists. The website hashes your entry before anything leaves your browser. The HIBP API documentation explains the model, known as k-anonymity:

1. Your device hashes the password with SHA-1.
2. Only the first 5 characters of that hash are sent to api.pwnedpasswords.com/range/.
3. The service returns every hash suffix that shares that prefix, typically about 800 lines, each with a count of how many times it was seen.
4. Your device checks locally whether the rest of its hash is on the list.

The range API is free, needs no API key and has no rate limit, according to HIBP. If you are comfortable in a terminal, you can run the check yourself on Linux or macOS without typing the password into your shell history:

read -rs PW
HASH=$(printf '%s' "$PW" | shasum -a 1 | awk '{print toupper($1)}'); unset PW
curl -s -H "Add-Padding: true" "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep -i "^${HASH:5}:"

If the last command prints a line such as …:52, that password has appeared 52 times in breach data and should never be used again. No output means it is not in the dataset. The Add-Padding header pads the response to between 800 and 1,000 lines so that response size reveals nothing; padded lines have a count of 0. The per-email search API is different: it requires a paid API key, so for email lookups use the website.

Step 3: Run Google Password Checkup

If you save passwords in Chrome or on Android, Google Password Checkup scans all of them at once. According to Google Account Help:

• In Chrome: open the menu, choose Passwords and autofill, then Google Password Manager, then Checkup.
• In any other browser: go to passwords.google.com, select Go to Password Checkup, then Check passwords, and sign in if asked.

The report sorts results into three groups: compromised passwords that have been published online, reused passwords and weak passwords. Google recommends changing compromised passwords first. When Google introduced the technology in 2019, its Security Blog said it compared credentials against more than 4 billion known-unsafe logins, using hashing, k-anonymity and private set intersection designed with Stanford University cryptographers so that Google never learns the credential.

Step 4: Check Apple's Passwords app

On iPhone, iPad, Mac and Vision Pro, Apple's Passwords app (iOS 18, iPadOS 18, macOS Sequoia, visionOS 2 and later) does the same job for iCloud Keychain. Open Passwords, choose Security, and select any account marked as weak or compromised. Apple Support says the app flags passwords that are easy to guess, used for more than one account, or found in a known data leak, and recommends updating each one.

According to Apple's Platform Security guide, the leak check uses private set intersection: the leaked-password list is split into 2¹⁵ buckets based on the first 15 bits of a SHA-256 hash, so Apple learns no more than that short prefix about any password.

Step 5: Add ongoing alerts with Mozilla Monitor

Mozilla Monitor, formerly Firefox Monitor, is built on the Have I Been Pwned database. Mozilla's support pages say you sign in at monitor.mozilla.org, your primary email is scanned automatically, and you can add and verify up to 20 addresses on the free tier. It is useful if you want one dashboard for a family's or small team's addresses. It adds little if you already subscribe to HIBP's own "Notify me" alerts.

What to do if your data was breached: a 7-step checklist

A breach result is a warning, not proof that an account was taken over. Work through these steps in order, starting with the accounts that would hurt most to lose: email, banking, phone carrier and cloud storage.

1. Change the breached password everywhere you reused it. Attackers try leaked email-and-password pairs on other sites, a technique known as credential stuffing. A unique password per site stops one breach from spreading.
2. Use a password manager. CISA lists strong passwords, multifactor authentication with a password manager, phishing awareness and software updates as its four core steps for everyone. A manager makes unique passwords practical.
3. Switch to passkeys where offered, or turn on two-factor authentication. A passkey cannot be typed into a fake site, and a stolen password alone will not open an account protected by an authenticator app or security key. Our guide on how to set up passkeys on iPhone, Android, Windows and Mac walks through each platform.
4. Secure your email account first. Whoever controls your inbox can reset most other passwords. Review recovery addresses, recovery phone numbers and signed-in devices.
5. Freeze your credit if identity data leaked. If a breach exposed a Social Security number, date of birth or address, the FTC says a freeze is free to place and lift at Equifax, Experian and TransUnion and does not affect your credit score. You must contact all three bureaus. A free fraud alert lasts one year; an extended alert lasts seven years for confirmed identity-theft victims who file a report at IdentityTheft.gov or with the police. Outside the US, ask your bank or national credit bureau about equivalent protections.
6. Expect targeted phishing. Breached data is often used to make scam emails, texts and calls more convincing. Messages that quote a real order, account number or the breached company's name deserve extra suspicion. Go to the company's site directly rather than clicking the link.
7. Watch statements and keep checking. Review bank and card statements for small unfamiliar charges, keep HIBP or Mozilla Monitor alerts on, and repeat the password scan every few months.

Which breach data is most dangerous?

Not every exposure carries the same risk. A leaked email address mainly brings spam and phishing. A leaked password is urgent if it is reused anywhere. Leaked identity data, such as government ID numbers, dates of birth and home addresses, cannot be changed and can support fraud for years, which is why a credit freeze matters. Leaked medical or financial records, as in the Quest Diagnostics case, also call for checking insurance and benefit statements for services you did not receive.

If crypto keys or seed phrases were ever stored in email or cloud notes, treat them as compromised and move funds to a new wallet. Our guide on how to secure a crypto wallet seed phrase explains safer storage.

What it means

Large breach disclosures now arrive almost weekly, and record counts in the millions are routine. For most people the practical goal is not to avoid being in a breach, which is largely outside their control, but to make a breach harmless. A unique password for every site, plus passkeys or two-factor authentication on important accounts, means a leaked credential opens nothing. Checking takes minutes, the main tools are free, and the privacy-preserving designs used by HIBP, Google and Apple mean you do not have to hand over a password to find out whether it is already public.