How to Check If Your Email Has Been Leaked

Start with a dedicated breach-checking tool

Have I Been Pwned remains the standard free tool for this — it checks your email against a database of publicly disclosed, independently verified breaches. Enter your email, and it'll list which known breaches included it, along with what type of data was involved in each. This takes under a minute and is a reasonable first move for anyone who hasn't checked before.

Understand what counts as "leaked" here

A leak means your email appeared in a dataset that was stolen, scraped, or exposed from a service you used — a shopping site, a forum, an old app. It doesn't necessarily mean your email account itself was hacked; it usually means a company holding your email as a customer record was compromised, and your email got swept up as part of that dataset.

Check for password reuse specifically

Some breach checkers, including Have I Been Pwned's companion tool, let you check if a specific password has appeared in known leaked password lists — separate from checking the email address itself. This is worth doing for any password you suspect you've reused, since password reuse is what turns a minor breach into an actual account-takeover risk.

Check secondary and old email addresses too

Most people have more than one email — a personal one, an old college one, a "just for sign-ups" one. Check each of them, not just your primary daily-use address, since old or secondary emails are often where the oldest, most-forgotten accounts still live.

Go beyond breach checkers for a fuller picture

Standard breach-checking tools only cover publicly disclosed, catalogued breaches — they don't cover data broker listings, or breaches that haven't been discovered and indexed yet. For a broader view — including where your email shows up on aggregator and broker sites, not just in known hacks — a dedicated scan is more thorough. Scan My Shadow checks your email (alongside your phone number) across 1,500+ sources and sends back a report, catching what a single breach-checker alone would miss.

What to do once you find a leak

1. Change the password immediately on the specific breached service, and anywhere else you've reused it.
2. Enable two-factor authentication on that account and, ideally, on your email itself — since email is often the recovery point for everything else.
3. Check what type of data was exposed in that specific breach — a password-only leak is less urgent than one that also included financial or ID details.
4. Watch for a rise in phishing emails referencing the breached service, since leaked emails are commonly targeted with follow-up phishing campaigns.

Set up ongoing monitoring instead of a one-time check

New breaches are discovered constantly, and a clean result today doesn't guarantee a clean result in six months. Have I Been Pwned offers free email alerts for future breaches involving your address — worth signing up for so you're not relying on remembering to check manually.

Related Reading

• Have I Been Pwned India — a walkthrough for Indian users specifically.
• How to Check Multiple Email Addresses for Data Breaches — if you use more than one address.
• Have I Been Pwned Says No Breaches: Am I Safe? — what a clean result does and doesn't actually mean.
• Can Have I Been Pwned Find Every Data Leak? — the real limits of breach-only checking.
• What Should I Do If My Email Appears in a Data Breach? — the next steps once you find something.
• My Email Account Was Hacked — What to Do Right Now — the active-takeover version of this problem, not just a leaked address.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.