How to Check if Your Password Was Leaked (2026)

Last updated: November 1, 2026

If you’ve just read about a big data breach, or an app warned you that a password was “found in a data leak”, you’re probably wondering how to check if my password was leaked and what to do about it. The good news is that you don’t need any paid service. The password managers already built into Chrome, Android, iPhone and Mac can check your saved passwords for free, and Have I Been Pwned can tell you which breaches your email address appeared in.

Quick answer: On a computer, open Chrome and go to Google Password Manager > Checkup, or visit passwords.google.com in any browser and select Go to Password Checkup. On an iPhone or Mac, open the Passwords app and look under Security. To see which breaches your email address was caught in, search it on haveibeenpwned.com. If anything shows up as leaked or compromised, change that password right away, starting with your email account.

What These Checks Actually Tell You

There are two different questions here, and they need different tools:

• “Has a password I use appeared in a leak?” Google Password Checkup and Apple’s Passwords app compare the passwords you’ve saved with lists of passwords that have been published online after breaches. They can only check passwords they know about, so a password you type from memory and never saved won’t be checked.
• “Has my email address been caught up in a breach?” Have I Been Pwned searches its database of breaches for your email address and lists the services that leaked it, plus what kind of data was exposed (for example email addresses, passwords, phone numbers or dates of birth).

Use both if you can. The password checks tell you exactly which logins to fix, and the email check tells you which services had a breach involving you.

Method 1: Google Password Checkup (Chrome, Android, Any Browser)

If you let Chrome or your Android phone save passwords, they’re stored in Google Password Manager. Its Checkup feature looks for passwords that were exposed in a data breach, that you reuse on several sites, or that are weak and easy to guess.

On a Windows PC or Mac in Chrome

1. Open Chrome.
2. At the top right, select the three-dot More menu, then Passwords and autofill > Google Password Manager.
3. On the left, select Checkup.
4. Review the results. Select the arrow next to Compromised passwords to see exactly which sites are affected.

Tip: the three-dot More menu is at the far right of the Chrome toolbar. If your toolbar has a new Ask Gemini button you don’t want, see how to remove Gemini from the Chrome toolbar.

On an Android phone

1. Open the Chrome app.
2. Tap the three-dot More menu, then Settings.
3. Tap Autofill and passwords > Google Password Manager > Checkup.

In any other browser (Safari, Edge, Firefox)

1. Go to passwords.google.com and sign in to your Google Account if asked.
2. Select Go to Password Checkup, then Check passwords.

Google sorts the results into three groups: compromised (published online after a breach, so change these first), reused (the same password on several accounts) and weak (easy to guess). Google can also alert you automatically when one of your saved passwords turns up online. You can turn these alerts on or off at passwords.google.com > Settings > Password alerts.

Good to know: Google’s separate “dark web report” tool, which many older guides still recommend, was discontinued. It stopped scanning on January 15, 2026, and its data was removed on February 16, 2026. Password Checkup is still available and is the Google tool to use now.

Method 2: Apple Passwords App (iPhone, iPad and Mac)

On iOS 27 and macOS 27, your saved passwords and passkeys live in Apple’s Passwords app. It flags passwords that are weak, reused, or have appeared in a known data leak.

On iPhone or iPad

1. Open the Passwords app and unlock it with Face ID, Touch ID or your passcode.
2. Tap Security. (You may need to tap the back button first to see the list of categories.)
3. Tap an account. A message explains the problem, for example that the password appeared in a data leak.
4. Tap Change Password to open the website or app and set a new password. If you need the old password to make the change, tap the Password field and choose Copy Password first.

To make sure your iPhone keeps checking in the background, go to Settings > Apps > Passwords and turn on Detect Compromised Passwords.

On a Mac

1. Open the Passwords app.
2. Click Security in the sidebar. Accounts with weak or compromised passwords are listed.
3. Click an account, then click Change Password and update it on the website or in the app.

To turn ongoing checks on or off on a Mac, choose Passwords > Settings in the menu bar and select Detect Compromised Passwords.

Apple says this check works without revealing your accounts or passwords to Apple. Your device compares information calculated from your passwords against a list of leaked passwords, and your actual passwords are never shared. Apple also previewed a feature that changes weak or compromised passwords for you automatically, but it was held back from the first iOS 27 and macOS 27 release and is promised for a future update, so for now you change each password yourself.

Method 3: Have I Been Pwned (Email and Password Checks)

Have I Been Pwned (HIBP) is a free breach-search site that has been running for over a decade. It has two separate tools, and it’s worth knowing the difference.

Check your email address

1. Go to haveibeenpwned.com (type the address yourself rather than clicking a link in an email or ad).
2. Enter your email address and run the search.
3. Read the list of breaches. Each one shows the service, the date and which types of data were exposed.

Two points matter here. First, “not found” doesn’t prove you’re safe. HIBP itself says it holds only a small subset of all the data ever breached. Second, some breaches are classed as “sensitive” and won’t show in a public search. You only see those after signing in to the HIBP dashboard and verifying that you own the email address. You can also sign up for free notifications so HIBP emails you if your address appears in a future breach.

Check a password with Pwned Passwords

HIBP’s Pwned Passwords page tells you whether a specific password has ever appeared in a breach, and how many times. It’s designed so the password never leaves your device in readable form. Your browser turns the password into a SHA-1 hash, and only the first 5 characters of that hash are sent to the service. The site sends back every hash that starts with those characters, and your browser does the final comparison locally. This method is called k-anonymity.

That makes Pwned Passwords far safer than a random checker, but the password managers above are still the easiest option, because they check all your saved passwords at once and point you straight to the account that needs changing.

Why you should never type your password into a random “checker” site

Plenty of websites offer to “test if your password was hacked”. Unless you know exactly how a site handles what you type, assume it can see and keep your password. A fake checker is a very easy way for scammers to collect real passwords, especially if it also asks for your email address. Stick to the tools built into Google and Apple, or HIBP’s Pwned Passwords page, and never enter both your email address and your password on any checker.

The same goes for scary pop-ups that claim your phone has been hacked and ask you to call a number or sign in. Our guide to the iPhone hacked notification on Safari explains why they are scams and how to close them safely.

Found a Leak? Your “What to Do Next” Checklist

A leaked password is only dangerous while it still works. Work through these steps in order:

1. Change the leaked password first. Go to the website or app directly (not through a link in an email or text) and choose a new password you’ve never used anywhere else. Let Google Password Manager or the Passwords app suggest a strong one.
2. Change it everywhere you reused it. Criminals take leaked email and password pairs and try them on other sites. Checkup and the Passwords app both show reused passwords, so fix those next. Don’t forget your router: if your Wi-Fi password or router admin password matches one that leaked, change those too. Our guide on how to secure your home Wi-Fi shows how.
3. Secure your email account early. Whoever controls your email can reset most of your other passwords. If you’re already locked out of Gmail, follow our guide to recover a Gmail account without a phone number.
4. Turn on 2-Step Verification or a passkey. With a second step, a leaked password alone isn’t enough to get in. Passkeys go further, because there’s no password to leak at all.
5. Sign out of other sessions. For Google, go to your Google Account > Security & sign-in > Your devices > Manage all devices, and sign out of anything you don’t recognize. Many other services have a similar “devices” or “active sessions” list in their security settings. At home, check your router’s device list too: here’s how to see who is connected to your Wi-Fi.
6. Check your recovery details. Make sure the recovery phone number and recovery email on important accounts are still yours. Attackers sometimes change them.
7. Scan your computer if passwords keep leaking. HIBP also tracks “stealer logs”, which come from malware that records passwords as you type them on an infected computer. If new leaks keep appearing, run a full scan. Our guide to fixing a slow Windows 11 laptop shows how to run a scan with the built-in Windows Security app.
8. Watch for follow-up scams. After a breach, expect convincing emails and texts that mention the company that was breached. Don’t click their links or share verification codes.

Don’t forget the passwords that protect your backups. If you protect your WhatsApp chat backup with a password, it should be unique too. Our guide on how to back up WhatsApp on iPhone and Android explains end-to-end encrypted backups and why WhatsApp can’t reset that password for you.

Troubleshooting

Password Checkup or the Passwords app shows nothing

• These tools only check passwords you’ve saved. If you type passwords from memory, they have nothing to check. Save your logins first, or use HIBP’s email search.
• For Google, make sure you’re signed in to the right Google Account in Chrome or at passwords.google.com.
• On iPhone, confirm that Detect Compromised Passwords is on under Settings > Apps > Passwords.

You’re warned about an account you deleted years ago

• On iPhone or Mac, remove the old entry: open Passwords, go to All, and swipe left on the account. You can also tap the account in Security and choose Hide.
• In Google Password Manager, open Checkup, select the arrow next to Compromised passwords, then use the three-dot menu next to the site and choose Dismiss warning. Only do this if you’re sure the password isn’t used anywhere else.

The “leaked password” alert looks suspicious

• Don’t tap links in the message. Open Password Checkup or the Passwords app yourself. Google’s own advice is to go directly to Password Checkup to confirm that a notification is real. If the warning isn’t there, treat the message as a possible phishing attempt.

The Short Version

Checking whether your password was leaked takes about two minutes. Run Password Checkup or open the Passwords app’s Security section, search your email on Have I Been Pwned, and fix anything flagged, starting with your email account. Then add 2-Step Verification or a passkey, so the next breach can’t give anyone access on its own.

Official sources: Google Account Help: Change compromised passwords, Apple Support: Change weak or compromised passwords on iPhone and Have I Been Pwned: Pwned Passwords. More guides like this are in our Security & Privacy section.

Frequently Asked Questions

Securing your home network too? Start with our Home Wi-Fi & Router Security guides.

Worried about your Google Account? See our Gmail & Google Account Help guides.

Related guides

• Recover a Gmail Account Without a Phone Number (2026)
• How to Secure Your Home Wi-Fi (2026)
• How to See Who Is Connected to My Wi-Fi (and Kick Them Off)
• Windows 11 Laptop Slow? 9 Fixes That Work (2026)
• How to Remove Gemini From the Chrome Toolbar
• iPhone Hacked Notification on Safari? It’s a Scam