How to Check If My Password Was Exposed

A password is considered exposed when password-related information becomes available outside the system where it was supposed to remain protected.

That can happen after a data breach, account compromise, malware infection, phishing attack, or other security incident.

The important distinction is between:

They are not the same thing.

A password can appear in known exposure data even when nobody successfully logged into your current account.

But once a password is no longer secret, you should no longer rely on it.

This is especially important if you reused it.

NIST's current digital identity guidance emphasizes the importance of distinct passwords because attackers can try credentials compromised on one service against accounts on other services.

Imagine that you created the same password for an old shopping account, your email, a streaming service, and another website.

Years later, the shopping account experiences a security incident.

Even if your email provider itself was never breached, the password you used for your email may now be known because you reused it somewhere else.

An attacker can attempt that combination on other services.

This kind of activity is one reason using a unique password for each important account matters.

A password manager can make this practical.

NIST recommends password managers because they can create and store strong, unique credentials so that people do not have to memorize a different password for every service.

Password checking requires more caution than checking an email address.

Your current password is an authentication secret.

Treat it differently from ordinary identifying information.

Before entering a password into any checker, understand how the service handles it.

Do not provide your password:

A safe password-exposure system should minimize how much information needs to leave your device and should not require you to publicly reveal the password.

If you are unsure whether a website can be trusted, do not enter the password.

Instead, assume a password you strongly suspect has been exposed should be changed.

Changing a compromised password is usually more valuable than proving with absolute certainty where it came from.

If a password you currently use is known or strongly suspected to be exposed, replace it.

Do not wait for evidence that someone successfully logged into your account.

Change the exposed password.

Create a new credential that is not a variation of the old one.

Avoid transformations such as:

becoming:

The goal is a new, unrelated credential.

NIST recommends long passwords when passwords are necessary and recommends using a password manager to generate and manage them.

Change it everywhere you reused it.

This step is critical.

If the exposed password was used on five different accounts, changing only one leaves the other four vulnerable.

Then continue through less important accounts.

Turn on multifactor authentication.

After changing the password, enable MFA.

CISA recommends MFA because it adds another verification requirement beyond the password. If someone obtains the password, they may still be unable to complete the additional authentication step.

Where supported, passkeys are another strong option.

NIST describes passkeys as an authentication method that can reduce reliance on passwords and provide stronger resistance to phishing.

A password exposure does not automatically mean account takeover occurred.

Look for evidence.

If you find an unfamiliar session, sign it out.

If the service supports signing out every other session, consider doing so after changing your password.

The FTC recommends changing the password, signing out of devices, turning on two-factor authentication, and verifying recovery information after recovering a compromised account.

Checking an email address or username can help identify exposures associated with accounts where a password may also require attention.

An old exposed password may no longer create an immediate login risk if:

Even so, an old exposure can still teach you something important.

If you recognize that password as one you reused widely, check whether any forgotten accounts still use it.

Old accounts are easy to overlook.

Your current email might have a strong unique password while an old shopping account, forum account, or subscription still uses a credential that was exposed years ago.

That is possible.

Password exposures and identifier searches do not always produce identical results.

A password could become known through several routes, and not every dataset or security incident contains the same fields.

The safest approach is not to treat a negative email search as proof that a password is safe.

If you know or reasonably suspect a password is compromised, replace it.

A checker can only evaluate the information available to it.

The password could have been obtained through:

So the safest interpretation is:

rather than:

If you need to prioritize, protect your primary email account.

Email frequently serves as the recovery channel for other services.

Someone with access to your inbox may be able to initiate password resets elsewhere.

The FTC specifically highlights this risk when explaining why securing an email account is so important.

Your email account should ideally have:

Scammers know that breach warnings create urgency.

You might receive a message saying:

Your password has been compromised. Click here immediately.

Do not assume the message is genuine.

The FTC advises consumers who receive suspicious messages to contact the organization through a website or phone number they know is legitimate rather than relying on links contained in the message.

If you think a password may have been exposed: