Home > Security Guides > How to Check If Your Email, Phone or Password Was in a Data Breach

How to Check If Your Email, Phone or Password Was in a Data Breach

Find out if your email, phone number or passwords leaked in a breach using free official tools, then fix every exposed account in the right order.

m00s3c
November 1, 2026
November 1, 2026

Billions of email addresses, phone numbers and passwords have leaked in data breaches, and most people never get a letter about it. The good news is that you can check your own exposure for free in a few minutes. This guide walks you through the official and widely trusted tools for checking an email address, the passwords saved in your browser or phone, and any single password, plus what to do with the results.

A result that says you were exposed is not a reason to panic. It tells you which accounts to fix first.

Before you start

Only check accounts and passwords that belong to you.
Never type a password into a website that claims to check it. The tools below either check saved passwords inside your own password manager or send only a partial hash.
Keep a note of every account a tool flags. You will fix them in Step 6.

Step 1: Check your email address on Have I Been Pwned

Go to haveibeenpwned.com, enter your email address and select Check. The free service lists the public breaches that included your address and the types of data exposed in each one.

Some breaches are classed as sensitive, and the site’s FAQ says only the verified owner of an address can see them. To see every result, sign in to the dashboard, which verifies that you can receive email at that address. You can also sign up for notifications about future breaches. They are sent only to the address being monitored.

What success looks like: you have a list of breaches for each email address you use, with the data types exposed in each.

Step 2: Run Google Password Checkup

If you save passwords in Chrome or your Google Account, open passwords.google.com and select Go to Password Checkup, then Check passwords. In Chrome on a computer, you can also select More (the 3 dots at the top right), then Passwords and autofill, then Google Password Manager, then Checkup on the left. Google’s help page describes both paths.

Checkup flags compromised passwords, along with reused and weak ones.

What success looks like: Checkup shows 0 compromised passwords, or you have a list of the ones to change.

Step 3: Check passwords saved on your iPhone or Mac

Apple’s iPhone user guide says iPhone can monitor your saved passwords and alert you if they appear in known data leaks.

Review warnings: open the Passwords app and tap Security.
Turn on monitoring: open Settings, tap Apps, tap Passwords, then turn on Detect Compromised Passwords.
On a Mac with macOS Sequoia or later: use the Passwords app, which syncs with your iPhone through iCloud Keychain.

What success looks like: the Security section shows no compromised passwords, and Detect Compromised Passwords is on.

Step 4: Turn on Password Monitor in Microsoft Edge

If you save passwords in Edge, sign in to Edge with your Microsoft account or work or school account. Then go to Settings and more, then Settings, then Passwords and autofill, then Microsoft Password Manager, then More Settings, and turn on Scan passwords for leaks. Microsoft’s support article says Edge then checks your saved passwords against a database of known leaked passwords, and you can select Scan now at any time.

What success looks like: the Password Monitor page shows no unsafe passwords, or lists the ones to change.

Step 5: Check a single password from the command line

The Pwned Passwords API lets you check a password without sending it anywhere. Your computer hashes the password with SHA-1 and sends only the first 5 characters of the hash. The API returns every hash suffix that starts with those characters, and your computer looks for a match locally. No API key is needed.

On macOS or Linux, paste this into Terminal. It asks for the password without showing it on screen:

read -rs -p "Password: " PW; echo

HASH=$(printf '%s' "$PW" | shasum -a 1 | awk '{print toupper($1)}')

curl -s "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep -i "^${HASH:5}:" || echo "Not found in Pwned Passwords"

unset PW HASH

We tested it on November 1, 2026. The common password password123 returned a line ending in :2266543, meaning it has appeared in breaches more than 2.2 million times. A long random password returned “Not found in Pwned Passwords.” For extra privacy, add -H "Add-Padding: true" to the curl command, which pads the response to between 800 and 1,000 records.

What success looks like: the command prints “Not found in Pwned Passwords.” Any number means the password is burned and should never be used again.

Step 6: Fix what you found

Work through the flagged accounts in this order: email first, then banking and payment accounts, then everything else. Your email account can reset every other password, so it comes first.

Change each flagged password to a new, unique one. Our free password generator creates strong random passwords.
Change every account that reused it. Attackers try leaked passwords on other sites.
Turn on multi-factor authentication or switch to a passkey where the site offers one.
Sign out of other sessions on important accounts after changing the password.

What success looks like: rerunning Steps 2 through 4 shows no compromised passwords.

Step 7: Protect an exposed phone number

No free official tool searches every breach by phone number. If a breach notice or a breached account included your number, expect more scam calls and texts, and protect your mobile account from SIM swap and port-out fraud. The FCC adopted rules to protect consumers’ cell phone accounts from these attacks in 2023.

Call your carrier at the number on your bill and ask to set an account PIN or passcode.
Ask whether it offers a SIM or number lock and alerts for SIM changes and port-out requests, and turn them on.
Where a site allows it, use an authenticator app or passkey instead of text message codes.

What success looks like: your carrier account has a PIN, and any available lock is on.

Common mistakes

Assuming “no results” means you are safe. These tools only know about leaks that have been found and loaded.
Typing a password into an unknown checker site. Use the tools above or the tested command.
Changing only the breached site’s password. Reused passwords are the real risk.
Making a small change to an old password. Attackers try common variations. Use a new random password.
Ignoring infostealer infections. If passwords keep leaking, your device may be infected. Read our infostealer guide.