How to Know if Your Email Password Is Hacked (and What to Do)

Short answer: Go to haveibeenpwned.com, type in your email address, and it tells you exactly which data breaches exposed your details. If you get a hit, change that password everywhere you reused it and turn on two-factor authentication straight away.

Almost everyone I know has wondered at some point whether their email got hacked. The good news is you no longer have to guess. There are trustworthy, free breach-checking services that let you find out in seconds, and I run this check on my own accounts a few times a year.

How do I check if my email was in a data breach?

The tool I trust and use myself is Have I Been Pwned, run by security researcher Troy Hunt. It aggregates data from thousands of real breaches so you can see if your address appears in any of them.

1. Open haveibeenpwned.com.
2. Type your email address into the search box and press the button.
3. Read the result. Green means no known breach; red lists every breach your address appeared in, with dates and what data leaked.
4. Scroll down to see what was exposed in each breach: passwords, phone numbers, addresses and so on.

The site does not need your password to check an email, and it does not store what you type in a way that exposes you. You can also sign up for its free notification service so you get an email the moment your address turns up in a future breach.

How do I check if a specific password has leaked?

Have I Been Pwned also has a Pwned Passwords page that tells you if a password has appeared in any breach, using a privacy-preserving method where your full password is never sent. Better still, most modern browsers and password managers now do this for you automatically.

Tool	What it checks	Where to find it
Have I Been Pwned	Email in breaches, password in breaches	haveibeenpwned.com
Google Password Checkup	Saved passwords that are weak, reused or leaked	Chrome settings, then Passwords
Apple / iCloud Keychain	Compromised saved passwords	Settings, then Passwords, Security Recommendations
Password manager (Bitwarden, 1Password)	Breach and reuse reports	Built-in security dashboard

What should I do if my password was hacked?

Finding a breach is not a disaster if you act quickly. This is the exact sequence I follow.

1. Change the password on the breached account first, then everywhere you reused that same password. Reuse is what turns one leak into ten hacked accounts.
2. Turn on two-factor authentication (2FA) on your email above all. Your email is the master key that resets every other account.
3. Use an authenticator app or a hardware key rather than SMS where possible, since SIM-swap attacks can defeat text-message codes.
4. Check for unfamiliar recovery emails, phone numbers and forwarding rules in your account settings; attackers hide there to keep access.
5. Start using a password manager so every account gets a long, unique password you never have to remember.

How do I create passwords that survive breaches?

A strong password is long and unique, not clever. Length beats complexity, so a passphrase of several random words is both stronger and easier than a short jumble of symbols. My rule is one unique password per account, generated and stored by a password manager, so a leak from one site can never unlock another.

The tip most guides miss

Do not just check your main email; check every old address you ever used, including throwaway ones. Old accounts you have forgotten about are exactly where reused passwords hide, and a breach on a dead forum from a decade ago can still expose a password you quietly kept using. I keep a short list of every email I have owned and run all of them through the breach check together.

If you want to move to hardware-based 2FA, a security key is the strongest option for protecting your email. You can compare current models on Amazon.

This guide is general security advice; review and adapt it to your own situation, and if you handle sensitive or work accounts, follow your organisation's security policy.

Frequently asked questions

Is Have I Been Pwned safe to use?

Yes. It is a well-known, reputable service run by a respected security researcher, used by governments and major browsers. Checking an email never requires your password, and the password checker is designed so your full password is never transmitted.

My email showed up in a breach. Does that mean I am hacked right now?

Not necessarily. It means your details were exposed in a leak at some point. Change the affected password and any place you reused it, enable two-factor authentication, and you close the risk before it can be used.

Should I use SMS codes for two-factor authentication?

SMS is better than nothing, but an authenticator app or a hardware security key is stronger because text codes can be intercepted through SIM-swap attacks. Use app-based or hardware 2FA on important accounts where you can.

How often should I check for breaches?

Checking a few times a year is reasonable, and signing up for free breach notifications means you get alerted automatically whenever your address appears in a new leak.