Has Your Password Already Leaked? How to Check, and What to Do About It

Have I Been Pwned has catalogued 1,046 data breaches covering 17.8 billion accounts. I went through all of them to see what gets stolen, how long it takes to come to light, and how you can check your own passwords without handing them to anyone.

Viswateja Krottapalli

A while ago I was signing up for Hugging Face and the site kept rejecting my password. It was long enough. It had a capital letter, a number and a symbol. It met every rule on the form. The problem was something else: that exact password had already turned up in data breaches, so the site refused to let me use it.

That was a little alarming, and also a good idea on the site's part. When a password leaks from one website, it doesn't stay there. It goes into lists that attackers try against email, banking and shopping accounts everywhere. If you reuse passwords, a breach at a small site you've forgotten about can open the accounts you actually care about.

A strong-looking password isn't a secret one

Most sign-up forms still ask for the same recipe: eight characters, a capital, a digit, a symbol. The trouble is that millions of people follow it in the same way. Take a word, capitalise the first letter, add @123. Every password below passes the usual rules, and every one of them is in Pwned Passwords, the database of passwords that have appeared in breaches.

Passwords that meet the usual rules, and how often they've been seen in breaches

Reading this: P@ssw0rd has been seen 6.4 million times, Pass@123 6.4 million and Password@123 1.8 million. Even local twists don't help much: India@123 appears 1.3 million times, Krishna@123 268,000 and Hyderabad@123 17,000. For comparison, the classic weak password 123456 appears 210.5 million times. Attackers don't guess these one character at a time. They start with exactly these lists.

This is why the official guidance has changed. The US National Institute of Standards and Technology's password guidelines (SP 800-63B, revised in 2025) now tell websites to stop forcing a mix of character types, and to stop making people change passwords on a schedule. Instead, they should ask for longer passwords and check every new one against a list of known compromised passwords, just as Hugging Face did with mine.

Check a password without giving it away

Typing your password into a website to see whether it has leaked sounds like a terrible idea, and usually it is. The checker below is different, because your password never leaves this page. Your browser turns it into a fingerprint (a SHA-1 hash, 40 characters long) and sends only the first five characters of that fingerprint to Pwned Passwords. The service sends back every leaked fingerprint that starts the same way, usually around a thousand of them, and your browser looks for a match locally. Nobody, including me and Have I Been Pwned, learns what you typed. The same technique is used by password managers and browsers.

Good to know: a result of “not found” means the password isn't in any breach list Have I Been Pwned has seen. It doesn't make a short or guessable password safe. If a password you use is found, change it everywhere you've used it. To check your email address, use haveibeenpwned.com directly.

Breaches now carry more than passwords

Every breach in Have I Been Pwned records what was exposed. Across all 1,046 of them, 64% included passwords, 54% included people's names and 37% their phone numbers. Passwords top the list, but they aren't the whole story.

What gets exposed: share of all 1,046 breaches that included each kind of data

Reading this: nearly every breach includes email addresses, since that's how Have I Been Pwned matches a breach to you. Names, phone numbers, physical addresses and dates of birth are each in a quarter to a half of all breaches. Together they are enough to make a phishing call or message sound convincing.

The mix has also shifted over time. Below, each column is one year's breaches, by the year they happened. The red part is breaches that included passwords.

Breaches by the year they happened, with and without passwords

Reading this: in 2014–16, 86% of breaches included passwords. In 2024–26 it's 26%. Over the same years the share exposing phone numbers rose from 14% to 56%, and physical addresses from 15% to 48%. Part of the reason is good news: more sites now store passwords in ways that are hard to reverse, so there is less worth taking. Recent years will also keep growing, because breaches often surface long after they happen (more on that below). Try it: hover over a column for the numbers.

Fewer breached databases with passwords doesn't mean fewer stolen passwords. Two things have taken their place. The first is credential-stuffing lists: old breaches merged into huge files of email and password pairs, which attackers run against other sites to find people who reuse passwords. The single largest entry in Have I Been Pwned is one of these, with 2.0 billion email addresses gathered in 2025. The second is info-stealer malware, which copies saved passwords straight out of an infected computer's browser. Have I Been Pwned has loaded 6 collections of these logs, covering 730 million email addresses. A unique password doesn't protect you from a stealer, but two-factor authentication still does most of the time.

Closer to home

Indian services are well represented. 33 of the verified breaches are Indian companies, together covering 164 million accounts, and 20 of them included passwords. These are the biggest.

The largest breaches of Indian services, by accounts exposed

Reading this: the year in brackets is when the breach happened. Red bars are breaches that exposed passwords, and blue bars exposed other personal data without passwords. The largest is bigbasket in 2020, with 24.5 million accounts. Groceries, food delivery, travel, stockbroking, internet service, jobs: if you shop or bank online in India, the odds are good that at least one of these had your details.

You usually find out months later

A breach rarely becomes public the day it happens. The data might be sold quietly first, or the company might not notice. Comparing the date of each breach with the date it was added to Have I Been Pwned shows how long that gap can be.

Time from a breach to its appearance in Have I Been Pwned

Reading this: only 31% of breaches were added within a month. The median gap is about 4 months, and 35% took more than a year. Breaches added since 2023 have been quicker, at a median of 62 days. Use it: a clean result today doesn't mean you're in the clear for good. Sign up for free alerts (below) rather than checking once.

Where to check

Have I Been Pwned — enter your email address to see which breaches it appeared in. Use Notify me to get a free email when it turns up in a new one. Its Pwned Passwords page checks a password the same private way as the checker above.
Mozilla Monitor — a free scan and ongoing breach alerts for your email, built on Have I Been Pwned's data.
Your browser or phone. Google's Password Manager (Password Checkup) and Apple's Passwords app on iPhone and Mac check the passwords you've saved and flag any that have leaked, been reused, or are weak.
Your password manager. Bitwarden, 1Password and most others have a breach or “watchtower” report that does the same for every login you've stored.

Be wary of any other site that asks for your actual password to “check” it. If it doesn't explain how it keeps the password private, don't type it in.

What to do if you show up in a breach

Change that password, and every copy of it. The breached site is the least of it. Change it on every other account where you used the same or a similar password, starting with email and banking.
Use a password manager. It's the only practical way to have a different, long, random password for every site. You then remember one strong passphrase instead of fifty weak ones.
Turn on two-factor authentication for email, banking, UPI apps and social media. An authenticator app or a security key is safer than SMS codes, which can be stolen with a SIM swap.
Switch to passkeys where offered. Google, Apple, Microsoft, Amazon, PayPal and others support them. A passkey can't be reused, guessed or typed into a fake site, so there is no password to leak.
Expect better-targeted scams. A breach that leaked your phone number, address or order history makes a fake delivery message or “bank” call far more believable. No genuine bank or company will ask you for an OTP, PIN or password.
Don't change passwords on a schedule. Change one when there's a reason: it was in a breach, you shared it, or you typed it into a site you no longer trust. Forced regular changes mostly lead to Password@1, Password@2, and so on.

Leaks are now a normal part of life online. You can't stop a company from losing your data, but you can make sure that a password stolen from one site is useless everywhere else.

About the data

Breach figures come from the public breach list of Have I Been Pwned, downloaded on 7 November 2026 (1,046 breaches, after leaving out the few it flags as fabricated), used under CC BY 4.0. Account counts are email addresses, not people: one person with several addresses, or in several breaches, is counted each time. The year chart starts in 2011; earlier years have only a handful of breaches. Indian services means verified breaches whose Have I Been Pwned description identifies the company as Indian.

Password counts are from the Pwned Passwords range API on the same date. The checker on this page calls that API from your browser with only the first five characters of the password's SHA-1 hash, and asks for padded responses so even the size of the reply gives nothing away.