Go to Have I Been Pwned and type your email address into the search box. It will tell you if that address shows up in any known data breaches, and it does not ask for an account or a card. If you want a second opinion, F-Secure offers a similar free checker that emails you a report.
The Two Free Checkers Worth Your Time
Have I Been Pwned is the clearest free breach-checking service you will find. You type in an email address, and it searches a large collection of known breaches. The site also publishes a list of every breach it knows about, with details on what kind of data was exposed in each one. You do not need to create an account, and there is no payment card required for the basic lookup. The service works worldwide, with no country restrictions mentioned on the site. It is run as a breach-aggregation project, not as a paid tool, so you are not being sold anything when you use it.
F-Secure's Data breach checker works similarly. You enter an email address, and the service checks whether personal information linked to that address has appeared in any data breaches. It then emails you a report with recommended actions. Like Have I Been Pwned, there is no card required, and you do not need to sign up for an account beyond submitting your email address. The page does not mention any country limits, so it should work for you wherever you are. It is presented as a free checker from the company's own service page, with no ads or hidden costs mentioned.
Which one suits you? If you want to see the raw data and browse breach listings yourself, use Have I Been Pwned. If you prefer a report sent to your inbox with step-by-step advice, use F-Secure. There is no reason not to try both, since they are both free and take less than a minute each.
What a "Hit" Actually Means
A hit on either service means the email address you searched appears in at least one known breach. That does not mean your email account is hacked right now, and it does not mean your password is automatically compromised. It means that at some point, a service you used was breached, and the data from that breach included your email address.
On Have I Been Pwned, each breach listing shows exactly what kind of information was exposed. It might be just your email address, or it could include passwords, usernames, phone numbers, or even physical addresses. You can click through to see the details and judge for yourself how serious the exposure is. F-Secure's report does the same thing, though it is less detailed about the specific breach sources.
The important thing to understand is that a hit is a warning, not a verdict. It means you should take action, but it does not mean your accounts are already compromised. The data is out there, so you need to decide what to do next.
What to Do First After a Hit
If either service tells you that your email appears in a breach, do not panic. First, look at what data was exposed. If it is just your email address, the risk is mainly spam and phishing. If it includes a password, you need to act immediately.
Change the password for the affected account right away. If you used that same password anywhere else, change it there too. This is the most important step, because reusing passwords is how one breach becomes many. Then turn on multi-factor authentication wherever it is available. This adds a second step to logging in, so even if someone has your password, they cannot get in without your phone or authenticator app.
Do not bother changing every password you have ever used. Focus on the accounts that were actually breached, and then prioritize any account that shares a password with those. If you use a password manager, this is the time to generate unique, random passwords for every site. If you do not use one, consider starting, because the whole point of a breach check is to prevent future damage.
What Most People Get Wrong About Breach Checks
The biggest mistake is thinking that a breach check is a one-time event. Data breaches happen constantly, and new ones are discovered every week. Checking once and getting a clean result does not mean you are safe forever. You should run the check again every few months, or better yet, use a service that notifies you when new breaches are added.
Another common error is ignoring the results when the breach only contains an email address and no password. People assume that because there is no password, there is nothing to worry about. But an email address alone is enough for phishing attacks, and it can be combined with other data from other breaches to build a detailed profile of you. Treat any hit as a reason to be more careful, even if the exposed data seems minor.
Finally, do not assume that a breach checker is a security tool. It does not protect you from anything. It only tells you what has already happened. The actual protection comes from changing your passwords, enabling multi-factor authentication, and being careful about what you click in emails.
What to Check Before You Commit to a Breach Checker
Before you hand your email address to any service, ask yourself three questions. First, does the service require an account or a card? If it does, walk away. There is no reason to pay for a breach check when the free options work just as well. Second, does the service explain what it does with your email address after you submit it? A trustworthy service will be transparent about whether it stores your address, how long it keeps it, and whether it shares it with third parties. Third, does the service give you useful results, or does it just say "you have been pwned" and leave you hanging? A good checker will tell you exactly what data was exposed and what to do next.
Both Have I Been Pwned and F-Secure pass these tests. Have I Been Pwned is run as a public service and does not sell your data. F-Secure is a security company, and while it may use your email for marketing, it is not going to sell it to spammers. If you are worried about privacy, use Have I Been Pwned, which has a long track record of being a neutral, independent source.
Frequently Asked Questions
What if my email shows up in a breach but I never used that service?
That can happen if you used a "plus" address or a variation of your email for a specific site. It can also happen if the breach data is from a service you signed up for years ago and forgot about. Either way, treat it the same as any other hit: change the password for that service if you still have an account, and change any other password that matches it.
Can I check someone else's email address?
Yes, you can type any email address into these checkers. There is no verification that you own the address. However, you should only check addresses you own or have permission to check. Using these tools to check someone else's email without their knowledge is not illegal, but it is not a good idea, and it will not help you do anything useful with the results.
Is it safe to type my real email address into these sites?
Yes, it is safe to use your real address with Have I Been Pwned or F-Secure. They are legitimate services that exist to help you check for breaches. The risk is not from the checker itself, but from what you do with the results. If you get a hit, do not click any links in the report. Go directly to the affected service's website and change your password there.
How often should I check for breaches?
Once a month is a good habit. You can also set up a notification on Have I Been Pwned if you create a free account, but that requires an account, which the basic search does not. If you do not want to create an account, just put a reminder in your calendar to run the check on the first of every month. It takes less than a minute.
More on privacy email
This is one of the guides in Free Tools for Email Privacy. The others:
