Email data breach check

A data breach is when a site's user database ends up in the wrong hands: through a hack, a misconfigured server or an insider. Such databases usually contain email addresses, names, passwords (typically as hashes) and phone numbers. They are then posted on forums or sold, and eventually become available to almost anyone.

Your mailbox itself may never have been hacked. It's enough that you once signed up for a site that lost its data: an online shop, a forum, a delivery service or an old game. That's why the same address usually appears in several breaches from different years.

The main risk is credential stuffing. Attackers take email-and-password pairs from one breach and try them on other sites: email, banking, social networks, marketplaces. If a password is reused, a single old breach unlocks several accounts at once.

• Sign-ins to accounts with the same password, including your email, which is used to recover everything else.
• Convincing phishing: emails with your name, an order number or your old password in the subject.
• Scam calls and texts from people who know your phone number, name and address.
• Spam to an address that ended up on bulk mailing lists.
• Services opened in your name if ID data leaked.

For each breach found we show the site name, breach date, number of affected accounts and what data leaked. The most dangerous types are highlighted in red: passwords and hints, security questions, payment data, ID numbers and crypto wallet keys. If passwords are among the data, change the password on that site and everywhere you used the same one.

"Unverified breach" means the data looks credible but the site hasn't confirmed the incident. "Spam list" is a database of addresses compiled for bulk mailing, not a hack of a particular site. "Data from infected devices" means information stolen by malware directly from users' computers.

If you enter a website instead of an email, the check shows breaches of that site itself. It's a quick way to check the services you use, such as your favourite online shop or a work system.

• Change the password on the breached site and anywhere you used the same password. Start with your email.
• Use a unique password for each site: generate them and keep them in a password manager.
• Turn on two-factor authentication: an authenticator code or passkey is safer than SMS.
• Review active sessions and forwarding rules in your email settings: attackers often add their own address there.
• Don't click links in "suspicious sign-in" emails — open the site yourself and check notifications there.
• If payment data leaked, reissue the card and turn on transaction alerts.

Have I Been Pwned contains only breaches that became public and were verified. Some companies don't disclose incidents for years, and some databases are sold privately and never reach public lists. So even a clean result is a reason to keep unique passwords and two-factor authentication, not a reason to relax.

A password can also leak without any site being hacked: for example, when it's intercepted on open Wi-Fi or through a fake hotspot in a café or airport. Encrypt your connection in such places.

The address you enter is only needed for the duration of the check. We don't store it, write it to server logs or send it to analytics: only the outcome reaches analytics — whether breaches were found and how many. Domain breaches are matched on our own server against a copy of the public database, with no third-party requests. When we look up a specific address, it is sent to Have I Been Pwned over an encrypted connection solely to answer that request.