What to do if your password was leaked

No need to panic, but you should act today. These are the steps, in the order that makes sense.

Updated 12 October 2026. 6 min read.

What it means when your password has leaked

A service where you used it suffered a data breach, and the password ended up on a public list or for sale. From then on it gets tried automatically with your email on hundreds of sites. If you reused it, every account that shares it is at risk, not just the breached one.

You may have found out from an email from the service, a warning from your browser or phone, or because our checker found it. Either way, the plan is the same.

The steps, in order

Start with your main email account. If you used that password (or a similar one) for email, change it there first. Whoever controls your email can reset the password of everything else. Use a randomly generated 20-character one.
Change it on the breached service. If you cannot log in because it has already been changed, use “Forgot password” and, if that fails too, the service’s support.
Change it everywhere you reused it, and wherever you used variations (Rover1987, Rover1987!, Rover1988). Attack tools try those variations. A new, different password for each one.
Turn on two-factor authentication for email, banking and social media: an authenticator app, a security key or a passkey. Even if your password is stolen again, it will not be enough on its own.
Sign out of open sessions. Each account’s security settings usually have an option to sign out on all devices. Do it after changing the password.

For every change, a new random 20-character password.

Password generator

Check your email thoroughly

If someone got into your email, they may have left changes behind to stay in even after you change the password. Check the settings for:

Automatic forwarding and filters. A rule that forwards your mail to another address, or deletes security alerts, is the most common back door.
Recovery email and phone number. Make sure they are still yours.
Apps with access to the account and app passwords you do not recognize.
Recent activity: sign-ins from countries or devices that are not yours.

The following days

Be wary of “security” emails and texts. After a breach, messages arrive pretending to be from the affected service and asking you to “verify your account”. Always go to the site by typing the address yourself, never through the link.

Watch your bank accounts and purchases. If the breach included payment details, tell your bank and ask for a new card.

See which breaches include your email at haveibeenpwned.com. It tells you which services were affected and what data was exposed.

How to find out next time

Password managers and browsers (Chrome, Edge, Safari, Firefox) warn you when a saved password appears in a breach. Turn that option on.
Have I Been Pwned lets you subscribe for free to get an email if your address shows up in a new breach.
With a different, random password on every site, the next breach will only force you to change one.

Frequently asked questions

My password shows up in breaches but I was never notified. Was I hacked?

Not necessarily. The checker looks up the password, not your account: if it is a common one, someone else may have used it. But whoever used it, it is now on the lists that get tried first, so you should stop using it.

Do I have to change all my passwords?

Every one that is the same as, or similar to, the leaked one: yes, all of them. The ones that are different and randomly generated are not at risk from this breach. That is why having a unique password everywhere pays off.

Should I report it to anyone?

If money is involved, call your bank as soon as you notice. If someone has impersonated you or committed fraud, report it to the police or your national fraud reporting service (in the US, IdentityTheft.gov).