Password Leak Check: How to Find Out if Your Password Has Leaked
There are two different questions hiding in “has my password leaked”, and they need two different tools. This guide covers both, explains how a checker can test a password without ever seeing it, and tells you what the result actually means for the accounts you use.
By LeakNixThe short version
- To see which of your passwords have leaked, look up your email address. Breach records store the password next to the address, so an email lookup on LeakNix shows the breaches and the passwords that leaked with them.
- To test one specific password, use Have I Been Pwned’s Pwned Passwords. It sends only the first five characters of a hash of the password, so the password itself never leaves your device.
- To have this done for you continuously, turn on the leak check built into your password manager or browser. Chrome, Safari, Firefox, 1Password and Bitwarden all have one.
The one rule: never type a password into a site that does not explain how it avoids seeing it. A checker that asks for your plain password and your email together is collecting logins, whatever its homepage says.
Two questions, two tools
“Has this password leaked?” and “which of my passwords have leaked?” sound the same and are not.
The first is about the string itself. Summer2024! has leaked, from thousands of different people’s accounts, and that makes it a bad password for you even if none of those accounts were yours. Attackers try known-leaked passwords first, so any password that appears in a leak corpus is on the shortlist. A tool that answers this question takes a password and tells you how many times it has been seen. It does not know or care whose it was.
The second is about you. It asks which breaches contain your email address, and what password was stored beside it in each one. That is the question that tells you which accounts to go and fix. A tool that answers it takes an email address, never a password, and returns the leaked passwords from the breach data. This is what the LeakNix email check does, using LeakCheck and Have I Been Pwned as sources.
Most people want the second answer and go looking for the first, then paste a password into a search box and get a number back that does not tell them what to do. Start with the email lookup. Use the password test for the specific passwords you are thinking of keeping.
How a checker tests a password without seeing it
This is the clever part, and it is worth understanding because it is how you tell a safe checker from a credential harvester.
Have I Been Pwned’s Pwned Passwords service works like this. Your browser computes the SHA-1 hash of the password, a fixed-length fingerprint that cannot be reversed into the password. It sends only the first five characters of that hash to the service. Five hex characters match roughly one in a million hashes, so the service cannot tell which password you meant; it sends back every hash suffix it holds that starts with those five characters, typically several hundred, along with how many times each has been seen in breaches. Your browser checks whether the rest of your hash is in that list. The password, and even its full hash, never leave your machine. The technique is called k-anonymity, and HIBP publishes exactly how it works.
Chrome’s Password Checkup, Safari’s Security Recommendations and Firefox’s monitor use variations of the same idea, with the check running against every password you have saved rather than one at a time. 1Password’s Watchtower and Bitwarden’s reports query HIBP’s range API directly.
How to tell a bad checker
- It asks for the password and the email address it belongs to on the same form.
- It does not explain the hashing, or claims to “search the dark web” for your exact password.
- The result page tries to sell you something before it shows you the result.
- It is not HTTPS. In 2026 that alone should end the conversation.
Where leaked passwords come from
When a check says your password has leaked, it came from one of three places. Which one changes what you should worry about.
1. A site stored it badly and got breached
RockYou, a widget maker, kept 32 million passwords in plain text and lost them in 2009; that file is still the first wordlist every password-cracking tutorial uses. LinkedIn hashed its passwords in 2012 but without salt and with SHA-1, so when the full dump of 117 million surfaced in 2016 most of them were cracked within days. Adobe lost 153 million accounts in 2013 with passwords encrypted rather than hashed, alongside the users’ own password hints, which turned out to be a very effective way to decrypt them. If your password is in one of these, it belongs to the site that leaked it and to every other site where you reused it.
2. Malware on a device copied it out of the browser
Infostealers such as RedLine and Lumma infect a computer, usually through a cracked-software download or a fake update, and copy every saved password out of Chrome, Edge and Firefox, along with the URL each one was saved for and the session cookies. The result, a “stealer log”, is sold in bulk. This is the fastest-growing source of leaked passwords and the most dangerous, because the passwords are current, in plain text, and labeled with the exact login page. In early 2025 Have I Been Pwned loaded a stealer corpus called ALIEN TXTBASE with 23 billion rows in it. The 2024 break-ins at Snowflake customers, including Ticketmaster, began with credentials from stealer logs and accounts that had no second factor. If your password came from a stealer log, a device you use is or was infected, and changing the password is step two. Cleaning the device is step one.
3. Somebody compiled it into a combolist
A combolist is a text file of email:password pairs stitched together from many breaches, cleaned up for use in credential stuffing tools that try each pair against hundreds of sites. Collection #1, which Troy Hunt loaded into HIBP in January 2019, had 773 million addresses and 21 million distinct passwords. “RockYou2024”, posted in July 2024, claimed 10 billion passwords and was mostly older material repackaged. Combolists are why your password can show up against a site you never used: the pair was copied from wherever it originally leaked and tried everywhere.
Running the check on LeakNix
Type your email address on the homepage. The address is looked up in LeakCheck, which indexes around 10 billion records including stealer logs, and in Have I Been Pwned, which as of September 2026 lists 1,034 breached sites. The two result sets are merged and a breach both sources hold is counted once.
The free result shows you:
- How many breaches hold the address, and their names and dates.
- How many of those included a password.
- The first characters of one leaked password, enough to recognize it.
- What other fields leaked: name, phone, address, IP, date of birth.
- A privacy score from 0 to 100 that drops for each of the above.
The full report is a one-off $28.95 and shows every breach and every password in full. The reason to pay is practical: if three passwords leaked, you need to know all three to know which accounts to change, and a partially masked one does not tell you that. There is no subscription.
What the check does not do, so you are not surprised: it does not search the dark web live, and no consumer checker does. It queries indexes of data that has already been dumped or traded. It also cannot find data that was never keyed to your email address, such as a Social Security number leaked in a file that did not include emails.
What the result means
A password appears against your email
Treat it as public. It is in files that are sold, traded, and loaded into tools that try it against every major site automatically. It does not matter that the breach was in 2016. Change it everywhere you used it, and do not change it to a variation of itself.
The password appears in Pwned Passwords but not against you
Someone else used it and lost it. It is now on the list attackers try first, so it is weak by definition. Replace it. This is the situation with most short passwords and anything based on a word, a name or a year.
Your email is in breaches but no password leaked
Better, not clear. The breach may have exposed your name, phone and address, which is enough for targeted phishing. And a breach that leaked hashed passwords may show as “no password” in the data while the hash is being cracked. If the breached site is one you still use, change the password there anyway.
Nothing found
Good news with a caveat. Not every breach is indexed, private trading never reaches the indexes, and a breach announced last week may not be loaded yet. Check again in a few months, and check any other addresses you use.
A password leaked. What to change, in order
- Your email account first. Whoever controls your email can reset every other password you have. If the leaked password was ever used there, change it now, then check the account’s settings for forwarding rules and recovery addresses you did not add.
- Banking, then anything holding a card. Amazon, PayPal, app stores, food delivery.
- Every other account that shared the password. You will not remember them all. A password manager will show you; if you do not have one, this is the moment. Our comparison is here.
- Do not add a 1 to the end. Cracking tools run rule sets that take every known password and try it with a digit appended, the first letter capitalized, an exclamation mark, the year. A variation of a leaked password is a leaked password with extra steps.
- Turn on a second factor, preferably a passkey where the site offers one, an authenticator app where it does not. Passkeys cannot be phished; codes can, but they still stop the attacker who only has the password.
- If the source was a stealer log, run a malware scan on every computer you have saved passwords on, and sign out of all sessions on your main accounts, because the log included the cookies too.
Questions people ask
My password leaked from a site I never signed up to. How?
Three common reasons. A combolist copied the pair from the site where it did leak and the index attributes it to the list, not the origin. A company you never dealt with directly held your data anyway, such as a data broker or a marketing partner. Or a device you use had an infostealer, which grabs every saved login regardless of site.
Does changing the password remove it from the leak?
No. The leak is permanent; the files are copied thousands of times. Changing the password makes the leaked one useless, which is the only outcome available and the only one that matters.
How often should I check?
Every few months, and after any breach announcement from a service you use. If your password manager or browser has a built-in check, leave it on and let it do the routine work; use an email lookup when you want to see what leaked rather than just that something did.
Is it safe to use my email on a checker?
Your email address is not a secret; it is the thing that is already in the breach. Looking it up does not add it to anything. What you should never do is give a checker the password that goes with it.
Find out which of your passwords are already out
One email address, a few seconds, no account. The free result shows the breaches and one leaked password; the report shows all of them.