A two-minute check tells you which breaches your address appeared in — and a few habits make sure the checking itself does not become the risk.

Data breaches are now so routine that the question is rarely whether a company you used has been hacked, but whether your details were in the pile that leaked. Breach-check services exist to answer exactly that: you give them an email address, and they tell you which known breaches it appeared in. Used properly, they turn vague worry into a short, specific to-do list.

How a breach checker works

The best-known service is Have I Been Pwned (HIBP), a free site run by security researcher Troy Hunt. "Pwned" is old gaming slang for "owned" — compromised. HIBP collects data from breaches after they leak, loads the email addresses into a searchable index, and lets anyone check an address against it. Two privacy choices define how it works, according to its own FAQ: when breach data is loaded, the passwords are not loaded alongside the email addresses; and searches are not logged — checks run over an encrypted connection, and the site points out that an email address on its own is not enough to break into anyone's account anyway.

How to check your email, step by step

1. Type the address yourself. Open your browser and go to haveibeenpwned.com by typing it in — never by clicking a link in an email, text or social post claiming you have been hacked. (Why this matters is covered in the warning section below.)
2. Enter one email address in the search box on the home page and run the check. The public search works one address at a time.
3. Read the result. If the address is not in any breach HIBP has loaded, you will get the good news. If it was found, you will see a list of the breaches, each naming the service, when it happened, and — most importantly — what types of data were exposed.
4. Click into each breach and note the data types. An email address alone is one level of problem; email plus password is a very different one.
5. Repeat for every address you have used, including old ones you barely remember — old accounts get breached too.
6. Optionally, sign up for notifications. HIBP can email you if your address appears in a future breach; verifying that you own the address also unlocks the full picture described next.

What the results really mean

Being "pwned" is a warning, not a verdict. It means your address appeared in data that leaked — not that someone is inside your accounts today. It also works the other way: a clean result is not a guarantee. HIBP's FAQ is honest that it holds only a subset of all breached records, because many breaches are never publicly released and some are never even detected: "absence of evidence is not evidence of absence." One more subtlety: a small number of breaches are classed as "sensitive" — sites where merely being a member could harm someone — and those are not publicly searchable. They become visible only when you sign in to HIBP's dashboard and verify you can receive email at that address, which proves you are checking your own account and not snooping on someone else's.

What to do next depends on what leaked

If only your email address (and maybe your name) leaked: expect more spam and more convincing phishing, because criminals now know a real address and where you held an account. The fix is vigilance, not password changes: treat unexpected messages about those services as suspect, and go to the official site yourself rather than clicking through.

If a password leaked with it: act the same day. Change that account's password to a new, unique one, then change it everywhere else you reused it — password reuse is what turns one site's breach into a takeover of your email and banking. Turn on two-factor authentication or a passkey while you are there. HIBP also runs a separate Pwned Passwords service that checks whether a password itself has appeared in breach data; it is designed so the password is anonymised before being sent, and it stores no link between a password and any person. And note HIBP's firm rule: it will never email you your exposed password — no legitimate service can "send you what leaked."

If identity or financial data leaked — dates of birth, identity numbers, card details — the response steps up again: watch statements closely, and use your country's official identity-theft guidance for options such as credit freezes where they exist.

Warning: fake breach-check sites are a real trap

The popularity of breach checking has made it a perfect costume for scams. Fake "were you hacked?" sites and pop-ups harvest exactly what a worried person might type in. Protect yourself with three rules:

• Never type your actual password into any checker, pop-up or "verification" page that is not the service's own login. A site asking for your email and your current password to "check if they leaked" is collecting the very pair criminals need.
• Reach the real checker by typing its address (haveibeenpwned.com) or through the security section of an account you already trust — not through ads, search-result lookalikes, or alarming messages urging you to check "right now."
• Refuse urgency. Genuine breach information does not expire in ten minutes. Pressure to act immediately, download a "cleaner," or pay for a check that the real service offers free is the scammer's signature.

HIBP's own FAQ makes the honest version of this point about itself: if you are concerned about any site's intent or security, do not use it. A legitimate tool can survive your caution; a fake one depends on you skipping it.

Checking takes two minutes, costs nothing, and replaces a nagging question with facts: which breaches, what data, what to fix. Do it for every address you own — and let the warning signs above, not a stranger's pop-up, decide where you type.

Sources

• Have I Been Pwned, "Frequently Asked Questions" — https://haveibeenpwned.com/FAQs
• UK National Cyber Security Centre, "Setting up 2-Step Verification (2SV)," updated 12 March 2025 — https://www.ncsc.gov.uk/guidance/setting-two-factor-authentication-2fa
• CISA, "Implementing Phishing-Resistant MFA," October 2022 — https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf

Related reading: Your Data Was in a Breach. Do These 7 Things Today · Passkeys and Two-Factor Authentication: Stronger Sign-Ins in 15 Minutes