How to Find Out if Your Password Has Been Stolen

HaveIBeenPwned.com is an online repository of email addresses and passwords that have been collected from publicly disclosed data breaches. Enter your email address and the site will tell you if that email address has appeared in data breaches and, if so, from which sites.

The site also offers a tool to find out if your password has been part of any data breaches. However it won't tell you which sites the password was found on, since this could make it possible for someone to piece together a username and password that hasn't been changed yet.

HIBP's list of sites where your account has been breached isn't comprehensive, especially if you've re-used a username and password combo on multiple sites. For example, if your login info for Dropbox was breached in the company's 2016 hack, an attacker could try it on other sites in the hopes that you reuse your username and password.

If you use the Chrome web browser, Google's Password Checkup extension will check your password against known data breaches when you sign into a site. This will not give Google your password, but it can give you a heads up when you're using an old password that might need to be changed.

Many password managers, including our Editors' Choice Keeper and Dashlane, offer services that will compare the email addresses and passwords against known data breaches. Password managers go a step further, letting you know if your passwords show up in data breaches and, in some cases, offering ways to update or change your password to keep your account secure. The specifics on how the feature works varies from one service to another, but if you use one (and you should) check it out.

If you want to find out if someone actually gained access to your account, many services offer a login history feature. Sites like Google and Facebook let you see a list of every login or attempt to log into your account and where it came from. If you think your account may have been accessed by someone other than you, check it out. If you find any strange activity, log out of those sessions and change your password. And activate two-factor authentication, which will cut down on the likelihood that someone will gain access to your account, even if they have your password.

Most tools like HaveIBeenPwned check your email address and password against publicly available lists of breached accounts. However, you can also monitor data breaches yourself with this online tool from Privacy Rights Clearinghouse. Search for specific companies to see if they've been breached or subscribe to a feed of breaches to find out when new ones happen. If you're seeing strange behavior on an account, it can't hurt to check if that company has been breached recently (and more importantly, if you've updated your account since then).

If you have indeed been hacked, here's what to do next.