Is Your Password Leaked?
Two things to check: (1) whether one of your accounts has shown up in a known data breach, and (2) whether the password you're using is actually strong. Both are free, private, and take a minute.
Check your email for known breaches
The most reliable way to check if your accounts are compromised is Have I Been Pwned, a free service run by security researcher Troy Hunt. It cross-references your email address against billions of records from real data breaches at companies like LinkedIn, Adobe, MyFitnessPal, and hundreds of others.
Check your email at haveibeenpwned.comWhat you'll see:
- "Good news — no pwnage found!" means your email hasn't appeared in any known breaches.
- "Oh no — pwned!" means your email was in one or more breaches. The site lists each breach, when it happened, and what data leaked (emails, passwords, phone numbers, etc.).
- If you're in a breach: change that account's password immediately. If you reused the password anywhere else, change those too.
Test a password's strength
Type a password you're considering (or one you already use) and we'll rate how strong it is. Nothing you type here is sent anywhere — all checks happen in your browser.
Private by design. This page runs entirely in your browser. Your password never leaves your device, never touches our servers, and is discarded the moment you close the tab.
A strong password is LONG, UNIQUE, and STORED.
- LONG — 16 characters or more. Length beats complexity every time.
- UNIQUE — different for every account. One breach shouldn't break ten accounts.
- STORED — in a password manager, not in your head or on a sticky note.
The 3 steps to fix weak passwords
Get a password manager
A password manager generates long, unique passwords for every site and remembers them for you. You only need to remember one strong master password.
Update your most important accounts first
Start with the accounts that can do the most damage if compromised: your email (because that's how other accounts get reset), your bank, and your main social media. Work your way down to less-critical accounts over the next week.
Turn on two-factor authentication
Even if a password leaks, 2FA (also called "two-step verification") stops attackers from getting in. It's the single highest-impact thing you can do for your online security.
Read our 2FA guide