TL;DR: You can check whether a password was leaked with your browser or password manager's built-in checker, with Pwned Passwords, and by checking your email for breaches. If a password appears, change it everywhere you used it and turn on two-factor authentication. Free tool: Scan My Shadow's digital footprint checker at scanmyshadow.com/digital-footprint-checker.
Passwords leak in data breaches, infostealer malware logs and credential dumps. "Password leaked" can mean two different things: the password itself appears in a known leak, or one of your accounts was breached. Check both.
Three free ways to check a password leak
- Your browser or password manager. Google Password Manager, Apple Passwords and most password managers flag compromised or reused passwords. Run the built-in check.
- Pwned Passwords. Have I Been Pwned's service lets you test a password without sending it in full; it uses k-anonymity, sending only the first five characters of a hash. Never type a live password into unknown sites.
- Check your email for breaches. Passwords leak with emails, so run the free Scan My Shadow checker or the email exposure check.
What the result means
- Password found in Pwned Passwords: other people have used it and it is in cracking lists. Retire it.
- Email found in a breach: reset the password on that service and anywhere it was reused.
- Nothing found: good, but not proof; new leaks appear constantly, see recent data breaches.
If your password was leaked
- Change it everywhere you used it, starting with email and banking.
- Choose a new one using strong password examples and ideas.
- Turn on two-factor authentication or passkeys.
- Follow what to do after a password leak and, if an account was taken, what to do if your email is hacked.
Leaked password databases and dark web passwords
Leaked password databases exist on criminal forums and in research datasets. Do not download or use them; use a checker that never exposes your real password. See dark web monitoring and stealer logs.
Password leaker, hacked passwords and passwords compromised: the terms explained
A "password leaker" is usually a breach, malware log or leak site that exposes passwords. Hacked passwords and passwords compromised in a data breach are the same problem: the password is now known to attackers. An email and password leak means your address and password appeared together, which is the dangerous case. Data breach password checks, password breach checker tools and a password hack check all compare against known leaks. For a leak password check, use Pwned Passwords or your manager's check password leaked feature; for Google passwords breach and Gmail password breach worries, run Google Password Manager's checkup. Password leak list and leaked database passwords are criminal datasets: do not seek them out. Related: dark web passwords and recent data breaches.
Common worries include password breaches, passwords data breach lists, data leak passwords and 1Password breaches; the same steps apply: check, change, and enable two-factor authentication.
FAQs
How do I check if my password has been leaked?
Use your browser or password manager's checker, test it on Pwned Passwords, and check your email for breaches. If it appears anywhere, change it.
Is a password leak checker safe?
Reputable checkers such as Pwned Passwords use k-anonymity so your full password is never sent. Avoid unknown sites that ask you to type your password.
What are compromised passwords?
Passwords that have appeared in a data breach, malware log or leak, and can be used by attackers.
Where can I see a leaked password database?
Do not go looking. Use a checker that lets you test a password safely; downloading leaked databases is risky and unnecessary.
What should I do if my password was in a data breach?
Change it on that service and anywhere reused, enable two-factor authentication and watch for phishing.
Does Google check my passwords for breaches?
Yes. Google Password Manager includes a password checkup that flags compromised, reused and weak passwords. Apple Passwords and most password managers offer similar checks.
What if my password was stolen but I see no breach?
Malware on your device can steal passwords without any breach. Run a security scan, change passwords from a clean device and enable two-factor authentication.
What is a password leaker?
Usually a source that exposes passwords: a breached service, infostealer malware or a leak site. You cannot inspect it directly, but you can check whether your password appears in known leaks.
What is an email and password leak?
A leak where your email address and password were exposed together, so attackers can log in to your accounts. Change the password and anywhere it was reused.
Was my password manager hacked?
Password managers have had incidents. LastPass disclosed in 2022 that attackers copied encrypted vault backups, and 1Password reported a 2023 incident tied to Okta without user data being accessed. A strong master password and two-factor authentication limit the damage.
How do I check if my Gmail password was breached?
Use Google Password Manager's checkup, which flags compromised passwords, and check your email for breaches with a free tool.
Before scammers use your details, see them first: check what is already public about you.
Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.