Has my email been in a data breach? How to check free

To find out if your email has been in a data breach, enter the address at Have I Been Pwned. It is free, needs no account, and lists every known breach that contains your address along with what was exposed. Then act on the type of data that leaked, since a password needs a different response from a phone number.

Expect a yes. As of October 11, 2026, the service lists 1,043 breaches covering about 17.8 billion accounts. Being in one is normal for an address that has been in use for a few years. What matters is which breach, what data, and whether you still use anything that was exposed.

How do I check if my email was in a data breach?

There are three free checks, and they answer slightly different questions.

1. Have I Been Pwned (which breaches contain my address?)

Go to haveibeenpwned.com.
Type your email address in the box and select Check.
Read the result. "Good news" with "no pwnage found" means the address is in none of the breaches the site holds. "Oh no" with "pwned" means it is in one or more, and a timeline of them follows.
For each breach, read what was exposed. Every entry lists the kinds of data involved.
Select Notify Me to get an email if the address appears in a future breach.

Repeat for every address you use, including old ones that still receive password resets.

2. Your password manager (which of my saved passwords have leaked?)

Google: go to passwords.google.com, select Go to Password Checkup, then Check passwords. Results are sorted into compromised, reused and weak.
iPhone: open the Passwords app and tap Security. A message explains the problem for any account with a weak or compromised password. The setting that watches for leaks is called Detect Compromised Passwords.

3. Pwned Passwords (has this exact password ever leaked?)

On the Passwords page of Have I Been Pwned you can test a single password against every leak the service has seen. Use it for the passwords you keep in your head.

One thing to drop from older guides: Google's dark web report. Google stopped scanning on January 15, 2026 and removed the report on February 16, 2026, saying feedback showed it "didn't provide helpful next steps."

Is Have I Been Pwned safe to use?

Yes. It is a long-running public service that publishes how it works, and the two checks are built so that looking something up gives away very little.

Email search. According to the site's FAQ, searches are not logged, and the only logging is standard analytics and error diagnostics. When breach data is loaded, "no corresponding passwords are loaded with them," so the site holds no list of your logins. An email address alone, as the FAQ points out, is not enough to get into anyone's account.

Password search. Here the design matters more, and it is careful. Your browser hashes the password locally and sends only the first five characters of that hash. The service returns every leaked hash starting with those five characters, and the comparison happens on your side. The full password, and even its full hash, never leave your device. You can watch the request in your browser's developer tools.

Sensitive breaches. Some breaches, such as dating sites, are never shown in a public search, so nobody can look up whether you were a member. Only the verified owner of the address can see them, by signing in to the site's dashboard through an emailed link. The FAQ counts 89 of these, so a clean public result is not always the whole picture.

Be careful with lookalike checker sites that ask for an email address and a password together. No genuine check needs both in the same form.

I'm in a breach. Does that mean I was hacked?

No. It means a company that held your data lost a copy of it. Nobody has necessarily signed in to anything of yours. Whether you are at risk depends on what was in the copy.

Here is a detail most guides miss. Of the 1,043 breaches listed on October 11, 2026, 674 include passwords. About one in three exposes no password at all. For those, changing your password does nothing, and the useful response is something else.

What was exposed	What it enables	What to do
Email address only	More spam and more convincing phishing	Nothing to change. Be more skeptical of mail that mentions that company
Password	Sign-in to that site, and to any other site where you used the same password	Change it on that site and everywhere it was reused. Turn on two-factor authentication
Phone number	Scam texts and calls, and attempts to take over the number	Move sign-in codes off text messages where you can. Ask your carrier about port-out protection
Home address, date of birth	Identity checks that rely on "facts only you know"	Treat callers who know these details as unverified
Security questions and answers	Password resets on other sites that ask the same questions	Change the answers everywhere you used them. Made-up answers stored in a password manager work best
Card or bank details	Fraudulent charges	Call the bank, replace the card, review statements
Social Security number or government ID	New accounts opened in your name	Freeze your credit at all three bureaus
"Stealer logs"	Passwords captured by malware on a device you used	Scan that device first, then change every password from a clean one

On the credit freeze, the FTC's guidance is that it costs nothing to place or lift, does not affect your credit score, and lasts until you lift it. Anyone can place one at any time, without waiting for misuse.

The last row deserves a second look. Have I Been Pwned describes stealer logs as the result of "malicious software running on infected machines" that collects email addresses, passwords and the sites they were typed into. If your address appears in one, the leak came from a device, not a company. New passwords typed on that device would be captured again, so clean the device before anything else.

What should I do first?

In this order:

Your email password, if it was ever used on a breached site. The inbox resets everything else.
Any reused password. Attackers take leaked email and password pairs and try them on other sites automatically. A breach at a small forum becomes a break-in at a store where you used the same login.
Two-factor authentication on email, banking and your password manager.
Everything else in the list above, matched to what was exposed.

For replacement passwords, let your password manager generate them. For the few you type from memory, a random six-word passphrase is both stronger and easier to live with, and the free Secria passphrase generator makes one in your browser without sending it anywhere.

My email was not found. Am I safe?

Safer, not certain. The service's own FAQ is direct about its limits: it holds "but a small subset of all the records that have been breached over the years," many breaches never become public, and "just because your email address wasn't found here doesn't mean that it hasn't been compromised in another breach." Sensitive breaches are also hidden from public search. Treat a clean result as good news and keep the habits anyway.

Why am I in a breach for a site I never used?

Have I Been Pwned gives several ordinary explanations: the service was bought by or renamed from one you did use, your data was passed to it by another company, or someone else signed up with your address. Marketing lists are another source. The site flags some entries as spam lists, which are compiled from many places and were never a single company's customer database.

How do I make the next breach matter less?

You cannot stop companies from losing data. You can limit what each one has.

A different password everywhere. Then a breach exposes one login and nothing more.
A different email address per service. With email aliases, each site gets its own address that delivers to your real inbox. When an alias turns up in a breach or starts getting spam, you know exactly who leaked it, and you can switch that alias off without touching anything else.
A second factor that is not a text message, so a leaked phone number does not become a way in. Our guide to two-factor authentication methods ranks the options.
Fewer true answers. A site that does not need your real birthday does not need to be given it.

Frequently asked questions

Should I change my email address after a data breach?

Rarely. The address itself was already semi-public, and changing it does not undo the leak. Change the passwords involved and add two-factor authentication. A new address makes sense mainly for your most sensitive accounts, where using an address nobody else knows adds real protection.

Can I remove my email from a data breach?

Not from the copies that criminals trade. You can remove it from Have I Been Pwned's public search with the site's opt-out feature.

How often should I check?

Once now, for every address you use, and then let notifications do the work. Subscribe to Have I Been Pwned's alerts and keep your password manager's leak warnings switched on. There is no benefit in checking by hand every month.

Does a breach notice email mean I should click to "secure my account"?

No. Real breach notices and fake ones look alike, and scammers send fakes after every well-known breach. Go to the company's site yourself, sign in there, and change the password from your account settings.

The bottom line

Check every address you use, read what was exposed, and respond to the data type instead of changing one password and moving on. If you want each service to hold a different address from now on, Secria Mail includes aliases on its free plan.