How to Check If Your Data Was Leaked in a Breach

In short: The most reliable free checks are Have I Been Pwned, the password checkup built into your Google Account, and Mozilla Monitor, all of which pull from public breach data and never ask you to type a full password or card number. Official confirmation also comes directly from the company that was breached, or from public filings such as the California Attorney General's breach notice list. Checking more than one source matters, because no single tool sees every breach.

Finding out whether your information was exposed doesn't require paying anyone or handing over sensitive data to a stranger's website. A handful of free, well-documented tools cover most of what people need: your email address, your passwords, and in some cases your Social Security number. Each one has a different scope and a different blind spot, so the safest approach is to use more than one and to understand what each is actually checking.

What are the free, legitimate tools to check if my data was leaked?

Four sources cover the bulk of what a typical person needs: Have I Been Pwned for emails and passwords; the password checkup built into your Google Account; Mozilla Monitor for email-based breach alerts; and the official notices that companies and US state regulators are required to publish, such as the California Attorney General's breach notice list. None of these ask for payment or for your current password typed into a form that isn't your own account settings.

How does Have I Been Pwned check my email and passwords?

Have I Been Pwned lets you search an email address directly, and the site describes itself as a way to "Check if your email has been compromised in a data breach." Separately, its Pwned Passwords tool checks whether a specific password has appeared in known breaches, and it does this without ever sending your actual password to the service. Instead, "your password is hashed locally and only the first 5 characters of the SHA-1 hash are sent to the API. The service returns a list of matching suffixes, and the full comparison happens on your side so the password itself remains private," according to Have I Been Pwned's documentation. The limit is that HIBP can only show breaches it has been given data for — if a company never shared or confirmed a leak, it won't appear.

What does Google's password checkup tell me?

If you save passwords in your Google Account, open Password Manager from your Google Account and run its checkup; it flags three specific problems. According to Google Account Help:

"You can check if passwords in your Google Account are:

• Exposed
• Weak
• Used in multiple accounts To keep your accounts more secure, you can change any compromised passwords."

The same page describes Google alerting account holders when it finds saved passwords exposed online, with an option to control those alerts. This only covers passwords you've actually saved to your Google Account — it won't catch a password you use elsewhere that Google never stored.

What does Mozilla Monitor cover, and what are its limits?

Mozilla Monitor works on any browser, not just Firefox, and it draws its breach data from the same source as HIBP. "Mozilla Monitor gets its data breach information from a publicly searchable source, Have I Been Pwned," Mozilla's own support page explains. Its coverage goes back years: it "searches for your email in publicly-available data breaches back to 2007," per the Mozilla Support FAQ. Mozilla is explicit about what the tool can and can't do: "No one — not even Firefox — can prevent data breaches from happening. We can alert you about breaches that affect you. We can help you understand what you need to do to mitigate the risks." One useful detail for spotting phishing: "Mozilla Monitor emails will always come from [email protected]. Firefox will never ask you to enter your login credentials or password in an email," the FAQ notes. Some breaches are hidden from open search entirely — "Email addresses involved in sensitive site breaches are not publicly searchable for privacy reasons. You must be signed in or subscribed to Mozilla Monitor alerts," per the same source, so signing up for alerts catches more than a one-time search.

What if I never got a company notification letter?

A missing letter doesn't mean nothing happened — it can mean the company hasn't finished notifying people, used an address that's out of date, or the breach wasn't large enough to trigger every reporting requirement everywhere you've lived. In California, the law only requires a sample notice to be filed with the state when more than 500 residents are affected, and those filings are public: "The law also requires that a sample copy of a breach notice sent to more than 500 California residents must be provided to the California Attorney General. Below is a list of those sample breach notices," according to the California Attorney General's breach notice list. Running your email and phone number through HIBP or Mozilla Monitor, and checking your Google password checkup, can surface an exposure before any letter arrives, or confirm one you already suspect.

What should I check besides email—passwords, SSN?

Email is the easiest identifier to check because it's what most breach databases are built around, but it's not the only thing worth checking. Passwords deserve their own check through Pwned Passwords, since a password can be exposed in a breach that never touched your email at all — for instance if a site stored passwords poorly and leaked them separately. If a Social Security number may have been exposed, that calls for different steps than an email or password check; see Privacy Unpacked's guide on checking if your Social Security Number was leaked for what to do next.

How do I know if a breach checker is trustworthy?

A legitimate checker never asks you to type your actual, full password or a card number into its search box to "verify" it. Have I Been Pwned's Pwned Passwords tool only ever sends a partial hash, not the password itself, as described above — that's the model a trustworthy tool follows. Mozilla is equally direct that its real alerts never ask for login credentials by email, as noted on its support page. Any site, pop-up, or email that asks you to enter a complete password, a full card number, or a Social Security number before showing results is almost certainly a scam collecting the very data it claims to be checking.

What should I do once I find my data in a breach?

Once a check confirms your email or password turned up in a breach, the next move depends on what was exposed. If it was a password, change it immediately wherever it was reused — Privacy Unpacked's guide on what to do if your password was leaked walks through the steps. If it was a Social Security number or similarly sensitive ID, the response is different and more involved, covered in the guide on a leaked ID number.

Sources to check and bookmark

• Have I Been Pwned — Pwned Passwords: search your email, or check a password using k-anonymity hashing that never sends the full password.
• Mozilla Monitor FAQ: explains Mozilla's breach alert service, its 2007-onward coverage, and how to spot genuine alert emails.
• Google Account Help — compromised passwords: shows how Google flags exposed, weak, or reused saved passwords.
• California Attorney General — Data Security Breaches list: a searchable public archive of sample breach notices companies filed after affecting more than 500 California residents.
• What to do if your password was leaked: next steps once a check confirms a leaked password.
• What to do if your ID number was leaked: next steps if a Social Security number or similar ID was exposed.