How to Check If Your Email Was Leaked (and What to Do About It)

Originally published on Tutomod.

Data breaches hit the news constantly, and odds are your email address has been inside at least one of them.

Updated August 08, 2026, after a fresh review, with updated visuals and links.

Checking takes less than a minute, it's free, and if you're in there, the fix is very doable. Here's the whole process without the panic.

Short version: Run the check first, then read the results calmly. Details below.

The how to part

1. Run the check. Go to haveibeenpwned.com in your browser, type your email, and hit the button. This site, run by security researcher Troy Hunt, is the standard tool professionals use.
2. Read the results calmly. A green result means your address isn't in any known breach. Orange means it appeared in one or more, and the site lists exactly which companies and what data leaked (emails only, passwords, phone numbers...).
3. Change passwords on the breached accounts first. Start with anywhere the breach included passwords. If you reused that password on other sites, change it there too. That's the part that actually bites people: one leak opening many doors.
4. Turn on two factor authentication. For email, banking and social accounts especially. Even if a password leaks later, a code from your phone stops the intruder at the door.
   • An authenticator app beats SMS codes
   • Email accounts deserve 2FA the most, they reset everything else
5. Watch for suspicious sign in alerts. For a few weeks after a breach, keep an eye on 'new sign in' emails and password reset emails you didn't request. If one appears, change that password immediately.

Photo by Solen Feyissa on Pexels

Good habits to keep

• A password manager makes unique passwords painless. One breach can never cascade into others again.
• You can subscribe at the same site (Notify me) so you're emailed if your address appears in a future breach. Set it and forget it.
• Old accounts you abandoned are still your accounts. If a site you used in 2015 leaked, that password is out there.

Questions people ask

Is haveibeenpwned safe to use?
Yes. It doesn't ask for passwords and it's the reference site used by security teams worldwide.

My email was in five breaches. Am I doomed?
Almost everyone's is. What matters is whether your passwords are unique now. Fix that and old leaks lose their power.

Photo by Miguel Á. Padriñán on Pexels

Keep reading

• How to Turn On Two Factor Authentication Everywhere That Matters
• How to Download Music for Offline Listening (Spotify and YouTube Music)
• How to Use AI to Plan Anything: Trips, Meals, Workouts and Projects

Check once, clean up the few accounts that matter, subscribe to alerts, and breaches stop being scary headlines and turn into a solved chore.