Go to Have I Been Pwned and type your email address into the search box. That site is free, requires no account for a basic lookup, and does not ask for a payment card. It will tell you, within seconds, if your email appears in any known data breach.
The Two Services That Do This for Free, Right Now
Have I Been Pwned
This is the clearest free breach-checking service in the retrieved pages. You type an email address into the public site, and it checks that address against a database of known breaches. A “breach,” according to the site’s own FAQ, is an incident where data was inadvertently exposed in a vulnerable system. The site also publishes breach listings and explanations of what data was compromised in each incident.
If you get a hit, the breach pages show what kind of information was exposed, passwords, email addresses, names, or other fields, so you can judge what was compromised. The retrieved pages do not document a payment card requirement for the basic lookup, nor do they document that an account is required. The retrieved pages also do not document country limits for the basic lookup. The service is presented as the rights holder’s own breach-aggregation project; the retrieved pages do not state ads, a library model, or an open licence as the reason it is free.
F-Secure Data Breach Checker
This is a second option. You type in your email address, and the page says it checks whether personal information associated with that address has been exposed in data breaches. After the check, it emails you a breach report with recommended actions. The retrieved page does not document a card requirement, nor does it document that an account is required beyond submitting an email address. The retrieved pages do not document country limits for this checker. The page presents it as a free checker from the rights holder’s own service page; the retrieved pages do not document the funding model or licence.
If you get a hit here, it means personal information linked to the email address was found in data breaches. The page does not give a more detailed definition of the result beyond that.
What a Hit Actually Means
Most people assume a hit means their account is hacked or their identity is stolen. That is wrong. A hit means the email address you searched appears in one or more known breaches. The breach pages at Have I Been Pwned show what kind of information was exposed in that specific incident. You might see that only your email address and an old password from a site you stopped using ten years ago were leaked. You might see that your name, address, and phone number were exposed. The hit is a signal to act, not a verdict that your accounts are compromised right now.
What to Check Before Committing to One Service
Before you type your email into any checker, confirm three things. First, the service should not ask for a credit card or a new account just to run a single lookup. Both services named above meet that condition. Second, the service should tell you what data was exposed in each breach, not just a yes-or-no answer. Have I Been Pwned does this clearly; F-Secure emails a report. Third, the service should be run by a known organisation that publishes its own breach data or works from verified sources. The retrieved pages show that Have I Been Pwned is the rights holder’s own breach-aggregation project, and F-Secure is a security company’s own service page.
Do not use a checker that asks you to install software, grant permissions to read your email inbox, or pay a fee before showing results. The two services above do none of those things.
What to Do First After a Hit
The retrieved guidance says to review what data was exposed in the breach listing. If a password was exposed, change that password immediately, especially anywhere you reused the same password. Then turn on multi-factor authentication wherever the site or service offers it. That is the single most effective step you can take after a hit.
Frequently Asked Questions
Will checking my email on these sites send my address to spammers or advertisers?
Have I Been Pwned does not document that it shares submitted addresses with advertisers or spammers; the service is presented as the rights holder’s own breach-aggregation project. F-Secure emails a breach report to the address you submit, but the retrieved pages do not document that the address is used for anything else.
Do I need to create an account to search my email on Have I Been Pwned?
No. The retrieved pages do not document that an account is required for the basic breach lookup on the public site. You can type an email address into the search box and get a result immediately.
What if my email is not found in any breach? Am I safe?
No. A clean result means your email does not appear in the breaches that service has indexed. It does not mean your email has never been exposed in an unreported breach, a phishing attack, or a leak that has not been added to the database yet. Keep using unique passwords and multi-factor authentication regardless of the result.
Can I check someone else’s email address without them knowing?
Yes. Both services let you type any email address into the search box. There is no login or permission gate documented in the retrieved pages for the basic lookup.
Where this fits
This is one guide from Free Tools for Email Privacy.
