Data Leak Checker: What It Finds and What It Can't

A data leak checker takes your email address, looks it up in collections of data stolen in past breaches and tells you which of those breaches include you. If it finds you, it also tells you what kind of data was taken. That's what decides whether you change a password tonight or just watch out for phishing.

That's all it does. A one-off check is a snapshot: it doesn't scan your computer, and it can't tell you about a breach nobody has found yet. Watching for new breaches after today is what monitoring is for.

What a data leak checker searches

When a company gets breached, the stolen files often end up traded on forums or dumped in public. Breach indexes are services that collect those files, clean them up and make them searchable by email address. A checker is the front end of one or more of these indexes.

That has a consequence people don't expect. Different indexes hold different files, so two checkers can give you different answers for the same address, and both can be right. A breach one service added months ago might not be in another's collection at all.

What separates checkers is which indexes they search and how often those indexes are refreshed. Ask any product those two questions. The LeakNix check searches two breach indexes, Have I Been Pwned and a second one that carries the leaked credential pairs, so it can show you the password itself where Have I Been Pwned only shows the breach.

How to read your result

Found, and the breach included passwords

Treat that password as known to attackers. Even if the company stored passwords in scrambled (hashed) form, you have no way of knowing whether attackers have cracked yours.

The danger isn't really the breached site. It's every other site where you used the same password. Attackers take leaked email and password pairs and try them automatically on email providers, shops and banks. This is called credential stuffing, and it works because people reuse passwords. Change the password everywhere you used it, not just on the site that leaked it.

Found, but no passwords in the breach

Usually this means your email, name and maybe a phone number, home address or date of birth. You can't change those, and there's nothing to reset.

The real risk is better phishing. Someone who knows you shopped at a particular store can send an email that looks exactly like that store's. For a while, be suspicious of any message that mentions the breached company, especially one asking you to "confirm your details". If you need to check something with them, go to their site by typing the address yourself rather than clicking a link.

Nothing found

Good news, with limits. A clean result means nothing was found in what has been indexed, not that nothing exists. Before you relax, check your other addresses, especially old ones you signed up with years ago. Forgotten accounts on old sites are where your old passwords live, and old passwords tend to get reused.

Free tools do most of this well

For the basic question "has my email been in a breach?", the free tools are good.

• Have I Been Pwned, run by security researcher Troy Hunt, is free. It lists the breaches your address appears in and what data each one exposed. Its free notification service emails you when your address turns up in a newly added breach.
• Mozilla Monitor's free scan uses Have I Been Pwned's breach data, so expect similar results.
• Your password manager may already be checking for you. Google Password Manager's Password Checkup and Apple's Passwords app both flag saved passwords that have turned up in known breaches.

What Have I Been Pwned's email search won't tell you is which password leaked. It shows that your address was in a breach that included passwords, not what the password was. If you've used three or four passwords over the past decade, that leaves you guessing about which accounts to fix.

Its sister tool covers most of that gap. Pwned Passwords, also free on the Have I Been Pwned site, lets you type in a password and tells you whether it has turned up in any breach it holds. It's built so your actual password never leaves your device: your browser scrambles it first and sends only a small fragment of the scrambled version, and the matching happens on your side. Checking each of your old passwords this way is quick.

There's one thing it can't do. Pwned Passwords tells you a password is out there, not which breach it came from or whether it leaked alongside your address. A common password can show up simply because a stranger used it too. So treat a hit as "stop using this anywhere", and use the breach list for your address to work out which accounts were involved.

A leak is not the same as being hacked

A lot of people who search for a leak checker are really asking something else: has someone got into my email? Those are different questions.

A leak means a copy of your data is sitting in a file somewhere. Being hacked means someone is inside your account right now. A checker answers the first question. For the second, look at the account itself:

• Recent activity. Gmail has "Last account activity" at the bottom of the inbox. Microsoft accounts have a "Recent activity" page under Security. Look for devices or locations you don't recognise.
• Forwarding rules and filters. A common trick is a rule that quietly forwards copies of your mail somewhere else, or sends certain messages straight to the bin. Check your settings for any you didn't create.
• Recovery details. Make sure the backup phone number and email address are still yours.
• Sent folder. Look for messages you didn't send.

If anything looks wrong, change the password from a device you trust, sign out of all other sessions (both Gmail and Outlook have an option for this), then fix the forwarding rules and recovery details. You don't need any special software to do this.

After the first ten minutes

Once your email and any reused passwords are sorted, the rest can wait for a calmer evening. If a breach exposed your date of birth, home address or an ID number, look into freezing your credit or adding a fraud alert, depending on what's offered where you live, so it's harder for anyone to open credit in your name. Close accounts on old sites you no longer use, because each one is another copy of an old password waiting for the next breach. And keep the phishing advice above in mind for a few months, because breached details get reused long after the news has moved on.

Right now, though, put the oldest email address you can remember (the one you signed up to everything with years ago) into the free LeakNix check, which draws on Have I Been Pwned among its sources, and see what comes back.