How to Check if Your Email or Password Has Been Hacked (2026 Guide)

Short answer: Go to haveibeenpwned.com, type in your email address, and it tells you which known data breaches included your details. If you show up in any breach, change that password everywhere you reused it and switch on two-factor authentication today.

I have lost count of how many times a friend has messaged me in a panic asking "is my email hacked?" after seeing a weird login alert. The honest truth is that most people have some data floating around from an old breach, and that is fine as long as you react properly. In this guide I walk through the exact checks I run and the cleanup I do afterwards.

What "hacked" usually means

When I say an account was compromised, I normally mean one of two things. Either your password leaked in a bulk data breach of a website you used, or someone guessed or phished it directly. The first case is far more common. Companies get breached, the stolen username and password lists get traded online, and attackers try those same combinations on other sites. That trick is called credential stuffing, and it only works because so many of us reuse one password everywhere.

Step 1: Check your email against known breaches

My first stop is always Have I Been Pwned, run by security researcher Troy Hunt. It aggregates billions of leaked records from confirmed breaches.

1. Open haveibeenpwned.com.
2. Type your email address into the search box and press pwned?.
3. Read the results. A green screen means no known breach. A red screen lists every breach your address appeared in, with the date and what data leaked (passwords, addresses, phone numbers, and so on).

The site does not store or capture your address to spam you, and it never shows your actual password. It only tells you where you were exposed.

Check a specific password too

There is a companion tool at haveibeenpwned.com/Passwords that tells you if a specific password has ever appeared in a leak. It uses a clever method called k-anonymity, so your full password never leaves your browser. If a password you still use shows up even once, retire it everywhere.

Step 2: Look for the warning signs on your account

Breach databases are historical. To spot a live intrusion, I check these directly in my account:

• Recent activity / security log. In Gmail, scroll to the bottom of the inbox and click Details under "Last account activity" to see recent sign-in locations and devices.
• Sent items you did not send. Spam blasted from your address is a classic sign.
• Forwarding rules and filters you did not create. Attackers love to silently forward your mail to themselves.
• Password reset emails for other sites that you did not request.

Step 3: Lock it down

If you found yourself in a breach or spotted suspicious activity, here is my exact cleanup routine.

Action	Why it matters	How long it takes
Change the breached password	Stops attackers using the leaked one	2 minutes
Change it everywhere you reused it	Kills credential stuffing	10 to 30 minutes
Turn on two-factor authentication	Blocks logins even if the password leaks again	3 minutes
Start using a password manager	Unique password per site, automatically	One-time setup
Review connected apps and sessions	Kicks out any device the attacker added	5 minutes

Step 4: Get a real password manager

The single biggest upgrade I ever made to my security was letting a password manager generate a long random password for every site. I never reuse anything now, so one leak can never cascade. Free, well-audited options include Bitwarden and the manager built into most browsers. If you prefer a hardware backup for your most important accounts, a physical security key like a YubiKey is worth it, and you can browse current models here: security keys on Amazon.

A non-obvious tip

Set up breach monitoring so you never have to remember to check again. On Have I Been Pwned there is a free Notify me option that emails you the moment your address turns up in a new breach. I subscribed years ago and it has quietly caught two leaks before I would have noticed them any other way.

Frequently asked questions

Is Have I Been Pwned safe to use?

Yes. It is a respected, free service run by security researcher Troy Hunt. It does not store the email you search in a way that spams you, and the password checker never sends your full password over the internet.

My email is in a breach. Does that mean I am hacked right now?

Not necessarily. It means your data leaked from some site at some point. If you have already changed that password and enabled two-factor authentication, the exposure is mostly harmless. The danger is only if you still reuse that old password somewhere.

Should I change all my passwords?

Change any password that was breached and any place you reused it. Going forward, use a password manager so every account has its own unique password and this stops being a chore.

What is the fastest single thing I can do to stay safe?

Turn on two-factor authentication on your email account. Your email is the master key that can reset everything else, so protecting it first gives you the biggest safety boost.