What to do if your password was leaked
2 min read · Updated October 15, 2026
Treat the leaked password as public. Change it on the affected account immediately, then change it everywhere else you used it or something similar. Switch to a unique password per account in a password manager, and add two-factor authentication so a stolen password alone cannot get in.
Why a leaked password is a real risk
Attackers load leaked email and password pairs into automated tools that try them against many popular services. This is called credential stuffing. It works whenever a person reuses a password, even years after the original breach.
Find everywhere you used it
Think back to which accounts might share that password or a close variation (for example the same word with a number added). Your browser’s saved passwords, your password manager and your email’s account-creation confirmations are good places to search.
- ✓Email accounts, banking, payment apps and shopping sites come first.
- ✓Social media and cloud storage next.
- ✓Everything else after, starting with services holding personal data.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Create a replacement that cannot be guessed from the old one
Do not just add a character to the old password, because attackers test those variations. Generate a random password with a password manager, or use a long passphrase of several unrelated words for the few passwords you must remember.
Add a second lock
Two-factor authentication means a stolen password is no longer enough. Authenticator apps, passkeys and security keys are stronger than SMS codes, though SMS is still better than nothing.
Fix it in 15 minutes
- 1Change the password on the account that was exposed.
- 2Change your email account password if it matched or resembled the leaked one.
- 3Search your password manager or browser for the old password and replace each match.
- 4Turn on two-factor authentication for email, banking and any account with payment details.
- 5Sign out of other sessions on those accounts.
- 6Check your email address with a breach checker to see what else was exposed.
Frequently asked questions
Does a hashed leaked password put me at risk?+
Hashed passwords are harder to use, but weak ones can be cracked. Change it anyway if you reused it.
How do I know which password leaked?+
A breach report lists the service and date, which tells you which account and which password to look at.
Is a password manager really safe?+
A reputable manager with a strong master password and 2FA is far safer than reusing passwords from memory.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.