Breach Check: Have You Been Pwned?

Have I Been Pwned is a free, independent service that tracks data exposed in known breaches. It offers two quick checks via its website.

“Pwned” (pronounced like “owned”) began as a typo of “owned” in gaming and hacker slang, where it means beaten or taken over. Here, it means your data was exposed.

Both buttons below open Have I Been Pwned in a new tab. Have I Been Pwned’s privacy policy applies there, and we don’t see what you enter or your results.

Check your email (opens in a new tab)

Is your email in a breach?

See which known data breaches include your email address.

Check a password (opens in a new tab)

Has a password been exposed?

See whether a password appears in known breach data. Have I Been Pwned explains on its own site how this check handles your password.

Only enter a password on haveibeenpwned.com by using the Check a password button above, never from a link in an email. Some password managers can run this check for you instead.

Found in a breach?

If your email shows up: change the password for that account and anywhere else you’ve used it. Turn on two-step sign-in where the service offers it, and watch for phishing messages that mention the breach.
If a password shows up: stop using it. Replace it with a new, unique password everywhere it’s in use. A password manager helps. The password may have been exposed by someone else who used it, but attackers try known passwords first.
If nothing shows up: that’s good news, not a guarantee. The checks only cover breaches Have I Been Pwned knows about.

If a check shows your email or a password in known breach data, treat that as a prompt to change passwords and turn on two-step sign-in. If you want help thinking through next steps for your organization, contact us. We can help.