Password leaked? What to do first: change that password on the account it belongs to, then change it on every other account where you used the same or a similar password. Reused passwords are what turn one leak into several hacked accounts.
Then turn on two-factor sign-in (or a passkey), check that your email account is still yours, and switch to a password manager so every account gets its own password. You can check whether a password is already in known breaches with our free password leak checker.
This guide is part of our security guides. It works whether you found out from a company’s breach email, a warning on your phone, or a strange login alert.
How you usually find out a password leaked
Most people learn about a leak in one of four ways. Each one means something slightly different, so it’s worth knowing which you have.
- A breach notice from a company. A store, app or service tells you its systems were hacked and customer data was taken. Your password for that one site may be exposed.
- A warning from your phone or browser. iPhone can alert you when a saved password appears in a known data leak. Google Password Manager shows passwords it flags as Exposed. These warnings mean the password itself has turned up in leaked data.
- A login alert you don’t recognize. A “new sign-in” email or a code you didn’t ask for means someone may already be trying the password.
- Friends say you messaged them. If contacts get odd messages or links from you, the account may already be taken over. Skip ahead to the section on hacked accounts.
Breach emails are also a favorite disguise for phishing. Don’t click a “reset your password” link in a message you weren’t expecting. Open the app or type the site’s address yourself.
Password leaked: what to do, step by step
Work through these in order. The first two steps matter most and take only a few minutes.
- Change the leaked password on that account. Sign in through the official app or website and set a new password. The FTC’s advice after a breach is to change it immediately, and also on any account where you used a similar password.
- Change it everywhere you reused it. Criminals take leaked email-and-password pairs and try them on banks, email, shopping and social sites. Changing one copy isn’t enough. Start with email and banking.
- Make every new password long and unique. CISA recommends at least 16 characters, either random letters, numbers and symbols, or a passphrase of four to seven unrelated words. Our password generator can make either one in your browser.
- Turn on two-factor sign-in. CISA calls this multifactor authentication (MFA). It may be labeled two-factor authentication or two-step verification in the account’s security settings. Even if a password leaks again, the thief also needs the second step.
- Secure your email account. Your email can reset almost every other password, so check it carefully (see the next section).
- Sign out of other devices. Many accounts have an option to sign out everywhere. Use it after changing the password so anyone who already got in is kicked out.
If a site offers a passkey, use it. A passkey replaces the password with your phone’s face, fingerprint or screen lock, so there’s nothing to leak or type into a fake site. Here’s how to set up passkeys on your main accounts.
Check your email account first
The FTC points out that your email is the key to your other accounts: whoever controls it can reset your passwords and lock you out. Once you’ve changed the email password, check these settings:
- Recovery email and phone number. Make sure they are ones you control. Attackers sometimes add their own.
- Forwarding rules and filters. Delete any you didn’t create. A hidden rule can quietly send copies of your mail, including reset codes, to someone else.
- Sent and deleted folders. Look for messages you didn’t send.
- Signed-in devices. Remove anything you don’t recognize.
- Two-factor sign-in. Turn it on here before anywhere else.
Find every account that used the leaked password
The hard part is remembering where else you used it. Your phone and browser can help, because they already know which passwords you saved.
On iPhone
- Open the Passwords app.
- Tap Security. Accounts with weak or compromised passwords are listed with a message explaining the problem.
- Tap an account, then tap Change Password to go to the site or app and change it.
- To make sure alerts stay on, go to Settings → Apps → Passwords and turn on Detect Compromised Passwords.
Apple notes that when you change a password, the site may offer a passkey or Sign in with Apple instead. Take that option when you can.
In Chrome or Google Password Manager
- In Chrome on a computer, select More (top right) → Passwords and autofill → Google Password Manager, then select Checkup on the left.
- Or, in any browser, go to passwords.google.com and select Go to Password Checkup → Check passwords.
- Fix anything under Exposed first, then Used in multiple accounts, then Weak.
On Android phones, the same Password Checkup works through your Google Account. Menu names can differ slightly by phone and Android version.
Check a single password
If you want to know whether one specific password has ever shown up in a breach, type it into our password leak checker. Only the first 5 characters of its SHA-1 fingerprint leave your device, never the password itself. If it’s found, stop using it everywhere.
Stop the next leak from hurting you
You can’t stop companies from being hacked. You can make sure a leak at one of them only affects that one account.
- Use a password manager. Both CISA and the FTC recommend one. It creates, saves and fills a different strong password for every site, and you only remember one master password. Free options are built into iPhone, Android and most browsers.
- Never reuse a password, even with small changes like adding a number. Attackers try those variations too.
- Turn on two-factor sign-in on important accounts: email, banking, social media, shopping and healthcare, as CISA suggests. An authenticator app or passkey is stronger than a text-message code.
- Keep your phone and computer updated. CISA lists software updates alongside strong passwords and MFA as basic protection.
If it doesn’t work: you’re already locked out
If the password was changed before you got to it, the account is likely hacked. Don’t panic, and don’t pay anyone who offers to “recover” it for you.
- Use the official recovery page for that service. Start from the app or the company’s own website, not a link in a message. The FTC’s hacked-account guide links to recovery pages for major services such as Google, Microsoft, Facebook, Instagram and WhatsApp.
- Scan your computer. The FTC suggests updating and running your security software, deleting anything suspicious and restarting, in case malware stole the password.
- Once you’re back in, set a new strong password, sign out of all devices, turn on two-factor sign-in and check the recovery email and phone number.
- Warn your contacts not to click links or send money in response to messages from your account.
- If you can’t get in at all, contact the company and ask how to recover or close the account.
If the breach also exposed your Social Security number or bank details, the FTC’s IdentityTheft.gov site has steps for each type of information. Report scams you run into along the way at ReportFraud.ftc.gov. Worried your phone itself is compromised? Read how to tell if your phone is hacked.
Related guide: How to Spot a Phishing Link Before You Tap It.
FAQ
How do I know if my password was leaked?
Check your phone’s password warnings (Passwords app → Security on iPhone, or Google Password Checkup), watch for breach notices from companies, and use a password leak checker for any password you’re unsure about.
Is it enough to change the password on the hacked site?
No. If you used the same or a similar password anywhere else, change it there too. Criminals try leaked passwords on many sites, starting with email and banking.
Should I delete the account instead?
If you no longer use it, closing it is reasonable once you’ve changed the password. Make sure no other account depends on it, such as an old email used for password resets.
Do I need to change passwords that weren’t leaked?
Only if they were reused or are weak. A unique, long password on a site that wasn’t breached is fine to keep.
Will two-factor sign-in stop a hacker with my password?
It blocks most attempts, because they also need your code, app approval or passkey. Never share a sign-in code with anyone who calls or texts you, even if they claim to be the company.
Sources
- Have you been affected by a data breach? Read on (Oct 2022), FTC Consumer Advice
- Use Strong Passwords (CISA Secure Our World)
- Turn On MFA (CISA Secure Our World)
- How To Recover Your Hacked Email or Social Media Account (FTC Consumer Advice)
- Change weak or compromised passwords on iPhone (Apple Support)
- Change compromised passwords in your Google Account (Google Account Help)
