In 2025 alone, over 1.5 billion credentials were exposed in data breaches. The question isn't whether your data has been in a breach — it's which breaches your data has appeared in and what you should do about it.
Have I Been Pwned (HIBP), created by security researcher Troy Hunt, is a free service that aggregates data from public data breaches. It lets you search for your email address or phone number to see which breaches it appears in. As of June 2026, HIBP indexes over 14 billion compromised accounts across hundreds of breaches.
The service has become the de facto industry reference for breach data. It powers the breach warnings built into web browsers, password managers, and operating systems, and its API is trusted by governments, banks, and security teams worldwide. Importantly, HIBP is non-commercial when it comes to your searches: it doesn't sell your data, doesn't email you marketing, and doesn't log the addresses you look up. That neutrality is a big part of why it has earned the trust of the security community.
https://haveibeenpwned.comEach result includes a short description of the breach, the date it occurred, the date it was added to HIBP, and the categories of data exposed. Pay close attention to that last detail. A breach that leaked only email addresses is an annoyance; one that exposed passwords, security questions, or payment details demands immediate action. Some entries are also flagged as "sensitive" breaches — these aren't shown in a public search and require you to verify ownership of the email first, precisely because their mere presence could be damaging.
Understanding how breaches happen makes it easier to see why checking matters. Your credentials can be exposed through several common routes:
The takeaway is that being included in a breach is rarely your fault and almost never fully within your control. What is within your control is how much damage each breach can do — and that comes down to using a unique password for every account.
HIBP also offers a Pwned Passwords service that lets you check if a specific password has been exposed in a breach — without sending the actual password over the network. It uses k-anonymity: you send only the first 5 characters of the password's SHA-1 hash, and the API returns matching hash suffixes.
The single biggest worry people have about breach-checking tools is reasonable: "Am I just handing my password to a website?" With Pwned Passwords, the answer is no, and the reason is a clever privacy technique worth understanding.
When you check a password, your device first computes its SHA-1 hash — a 40-character fingerprint that can't be reversed back into the original text. Instead of sending the whole hash, the tool transmits only the first five characters, a fragment shared by thousands of different passwords. The server replies with every leaked hash suffix that begins with those five characters, and your browser finishes the comparison locally. The server never learns which password you were actually checking, and your full password never crosses the network.
This is why security professionals are comfortable recommending the service even for passwords still in active use. That said, the safest habit is to check a password through your password manager's built-in monitoring, which performs the same k-anonymity lookup automatically and never requires you to type a live password into a search box at all.
Most of these tools quietly rely on the same underlying HIBP data, so the differences come down to convenience and coverage rather than accuracy. The advantage of a password-manager-based monitor over a manual search is that it watches your entire credential collection continuously, cross-references it against new breaches as they're indexed, and flags weak or reused passwords at the same time — turning a one-off check into ongoing protection.
Checking once and forgetting about it offers little protection, because new breaches surface constantly. Rather than setting a calendar reminder, automate the process:
Treat breach monitoring like a smoke detector: set it up once, let it run quietly in the background, and respond decisively when it sounds the alarm.
The throughline of every recommendation here is the same: unique passwords are what contain the blast radius of a breach. When every account has its own randomly generated password, a leak at one service stays isolated to that one service. When passwords are reused, a single breach becomes the key to your entire digital life.
It's also worth resisting the urge to panic when a result comes back positive. Appearing in a breach is now the norm rather than the exception — most people who have used the internet for more than a few years will show up in at least one. What separates a minor inconvenience from a genuine security incident is your response. A calm, methodical rotation of the affected password, paired with two-factor authentication and a password manager, neutralizes the threat in minutes. The goal isn't to never appear in a breach, which is largely out of your hands, but to make sure that when you do, the leaked credentials are already useless to whoever holds them.
Protect every account with a unique, strong password. Generate one now. Use a trusted password manager like NordPass to store and manage all your credentials securely.