By Tim O. · October 28, 2026 · 8 min read

Your Password Was Leaked: What to Do Now

Last verified: October 28, 2026

The 30-second version

A leaked password means a username and password you used were exposed, usually in a breach at a company you have an account with. The danger isn't only that one account. Attackers take leaked passwords and try them on email, banking, and shopping sites, betting that you reused them.

So the fix is simple and urgent: change the leaked password everywhere you used it, starting with your email, and turn on two-step verification. This page walks you through it, in order.

Where the warning came from

You probably found out in one of these ways. Each one is real, but check it directly rather than through a link in a message.

Google Chrome or Android: "Change your password" or a list of compromised passwords. Google's Password Checkup flags username and password combinations that "have been published online" (Google). To see the full list, open Chrome's menu, then Passwords and autofill, then Google Password Manager, then Checkup. Or go to passwords.google.com and choose Go to Password Checkup.
iPhone or iPad: a security recommendation saying a password "appeared in a data leak." Open the Passwords app to see which accounts are affected (iPhone Life).
A breach notice from a company, by email or letter.
A breach-checking site such as Have I Been Pwned, which shows whether your email address appears in known breaches.

Watch out for fake alerts. Scammers send "your password was leaked" emails with links to fake login pages. Never sign in through a link in an alert. Open the app or type the website address yourself.

What to do now, in order

1. Change your email password first

Your email is the master key: password resets for almost every other account go there. If the leaked password was ever used for your email, change it first, from a device you trust.

Make the new password long and unique. NIST's current guidance recommends at least 15 characters when a password is the only thing protecting an account (Enzoic, summarizing NIST SP 800-63B-4). Our free password generator creates one in your browser, and nothing is sent to us. Then check how strong it is with our password checker.

2. Change the leaked password everywhere you used it

This is the step people skip, and it's the one that matters most. Make a list of every account where you used the same or a similar password, and change each one. Start with banking, payment apps, shopping sites with saved cards, and social media.

Each account needs its own password. Adding a "1" or changing one letter doesn't count. Attackers try those variations automatically.

3. Turn on two-step verification

With two-step verification, a stolen password alone isn't enough to get in. Turn it on for your email, bank, and anything financial. Where possible, use an authenticator app or a passkey instead of text-message codes. Our page on what someone can do with your phone number explains why.

4. Check for signs someone already got in

Look at recent sign-in activity in your email and bank accounts.
Check for forwarding rules in your email settings you didn't create. Attackers add them to secretly copy your mail.
Look for password reset emails, new devices, or changed recovery details you don't recognize.

If you find any, sign out of all sessions, change the password again, and update your recovery phone and email.

5. Stop reusing passwords for good

You can't remember 100 unique passwords, and you shouldn't try. A password manager creates and remembers a different password for every account, fills them in for you, and tells you when one appears in a breach.

Which password manager to use

All of these are reasonable choices. The best one is the one you'll actually use.

Free and built in: Google Password Manager (in Chrome and Android) and Apple's Passwords app both save passwords and warn you about leaks. If you use only Apple devices or only Chrome, they're a solid start.

If you want one that works everywhere and watches for breaches:

Affiliate link. SPG earns a commission at no extra cost to you.

Proton Pass: has a generous free plan with unlimited passwords and devices. Pass Plus adds Dark Web Monitoring, a built-in two-factor authenticator, and unlimited email aliases, so you can stop giving out your real address.

Affiliate link. SPG earns a commission at no extra cost to you.

NordPass: an easy-to-use manager from the makers of NordVPN. Its paid plans include a Data Breach Scanner that checks whether your details appear in known leaks. Check NordPass's current plans for what's included at each level.

For a side-by-side comparison, see our best password managers guide.

What if my email was in a breach, but not my password?

That's common: many breaches expose only email addresses and names. It's lower risk, but expect more phishing and scam emails that use your name or mention the breached company. Don't click links in unexpected emails, and turn on two-step verification on your email account anyway.

If a breach included your phone number, see what someone can do with your phone number. If it included your Social Security number, see My Social Security Number Was Leaked.

Should you worry?

If you used the leaked password anywhere else: yes, act today. Reused passwords are one of the most common ways accounts get taken over. If the password was unique to that one account and you've changed it: low risk. Keep two-step verification on and move on.

Helping a parent with a leaked password

Older adults often reuse one or two passwords for everything, written in a notebook. If your parent got a leak warning:

Change their email password first, together, and turn on two-step verification.
Make a list of accounts that used the same password and change them one at a time.
Set up recovery contacts so they can get back in if locked out. See Recovery Contacts for Parents.
Consider moving them from a notebook to a password manager. Our guide to moving from a password notebook shows how, three accounts at a time.

Frequently asked questions

How do I check if my password has been leaked?

Run Password Checkup in Google Password Manager, check the security recommendations in Apple's Passwords app, or use a password manager with breach monitoring. To check whether your email address appears in known breaches, use Have I Been Pwned.

Chrome says my password was compromised. Is that real?

Usually, yes. It means that username and password combination was found in leaked data online. Confirm it by opening Google Password Manager directly, then change the password on that site and anywhere else you used it.

Do I need to change all my passwords?

No. Change the leaked one everywhere you used it, plus your email password if it was ever the same. Passwords that were unique and not flagged don't need changing just because of this leak. Current NIST guidance says to change passwords when there's evidence of compromise, not on a fixed schedule.

Will changing my password fix everything?

It stops the leaked password from working. If an attacker already got in, also sign out of all sessions, check for email forwarding rules, and update your recovery details.

Is it safe to type my password into a "check if it was leaked" website?

Don't type your password into websites you don't trust. Use the checks built into Google's or Apple's password managers, or a reputable password manager, instead.

The short version

Change the leaked password everywhere you used it, starting with your email. Turn on two-step verification. Check for signs someone already got in. Then use a password manager so one leak can never unlock more than one account.

Get the weekly password security brief

One breach, one fix, every week. No fluff.

Unsubscribe anytime. We never sell your email.

Sources

Checked October 28, 2026.

Tim O.

Tim O. writes practical consumer-security guides for SafePasswordGenerator.net. His analysis of 50,000 breached passwords has been cited across the security community.