Data breaches at companies large and small happen constantly, and there’s a good chance your email address has turned up in at least one, even if nobody ever notified you directly. The good news: checking is free, quick, and doesn’t require installing anything. Here’s exactly how to do it.
Step 1: Use Have I Been Pwned
Have I Been Pwned (haveibeenpwned.com) is a well-established, free, widely trusted tool run by a respected security researcher, used by security professionals and everyday people alike to check whether an email address has shown up in a known data breach.
- Go to haveibeenpwned.com in your browser
- Type your email address into the search box on the homepage
- Click pwned?
The site shows you either a green confirmation that your email wasn’t found in any known breaches, or a red list of the specific breaches it appeared in, along with details on what kind of information got exposed in each one (passwords, names, addresses, and so on).
This check is completely free, no account needed, and no personal information required beyond the email address you’re checking.
Step 2: Set Up Free Ongoing Breach Alerts
Beyond a one-time check, Have I Been Pwned offers free notifications for future breaches:
- On the homepage, scroll down and look for “Notify me”
- Enter your email address
- Confirm through the verification email you receive
You’ll now get notified automatically if your email shows up in any future breach, no manual checking required.
Step 3: Check Your Browser’s Built-In Breach Checker
Both Chrome and Safari now include their own built-in breach-checking tools, a convenient second check:
In Chrome: Go to Settings > Autofill and passwords > Google Password Manager > Password Checkup, which checks your saved passwords against known breaches and flags any needing attention.
In Safari (Mac or iPhone): Go to Settings > Passwords > Security Recommendations, which similarly flags saved passwords that have turned up in known breaches.
What to Do If Your Email Appears in a Breach
Step 1: Figure out what type of information was exposed. Have I Been Pwned typically lists exactly what each specific breach included — email addresses only, or also passwords, names, phone numbers, or more sensitive information.
Step 2: Change the password for that specific account right away, and for any other account where you reused the same one.
Step 3: Turn on two-factor authentication for the affected account if it’s not already active, adding a layer beyond just the password.
Step 4: Watch for follow-up phishing attempts. Breached email addresses often get targeted with phishing afterward, since scammers know the address is active and potentially vulnerable — be extra cautious of unexpected emails in the weeks following a breach notification.
Step 5: If financial or Social Security information was involved, consider a credit freeze as an extra precaution.
A Note on What a “Breach” Doesn’t Necessarily Mean
Finding your email in a data breach doesn’t automatically mean your specific account got hacked or misused — it means your information was part of a company’s database that got compromised, which could have happened years ago and may or may not have led to any actual harm. Still, treating every breach notification as a prompt to update the relevant password is a reasonable, low-effort precaution.
Checking Family Members’ Email Addresses Too
If you’re helping a parent or family member with their online safety, running their email through Have I Been Pwned too (with their knowledge and permission) is a simple, non-intrusive way to check for exposed accounts that might need a password update.
The Bottom Line
Checking whether your email’s been part of a data breach takes under a minute using a free, reputable tool like Have I Been Pwned, and setting up ongoing alerts means you’ll get notified automatically going forward. If your email does show up in a breach, updating the affected password and watching for follow-up phishing attempts are the most important next steps.
Note: This article reflects tools and features available as of 2026. Always access Have I Been Pwned directly at haveibeenpwned.com to avoid impersonator sites.