To find out whether a password of yours has been leaked, use a reputable breach-check service, the built-in warnings in your browser, or the security dashboard in your password manager. All three compare what you have against credentials already published, and the good ones never see your actual password. If you get a hit, the priority is changing that password everywhere you reused it, in the right order, starting with the breached account.
What a credential breach actually is
A breach happens when a company's user database is copied by someone who should not have it. It usually holds email addresses, usernames and password hashes, sometimes phone numbers or security questions. Weak hashing means those passwords can be turned back into readable text; strong hashing slows that down but does not save short or common ones.
The stolen data is then traded, merged with other breaches into large collections, and eventually published. A password you set years ago on a forum that no longer exists can surface long after you forgot the account, which is why breach notices arrive with no warning.
How breach-check services work
A reputable checker never asks for a password in plain form. It uses a technique called k-anonymity: your device hashes the password, sends only the first few characters of that hash, receives back every known leaked hash starting with them, and does the final comparison locally. The service learns which bucket you asked about and nothing else, and your full password never leaves your machine.
That is the test of whether a checker deserves your trust: if a site wants a complete password typed into a form so it can "check" it, close the tab.
The alerts you already have
Chrome, Firefox, Safari and Edge all check saved credentials against known breaches and warn you when one turns up. Password managers go further, flagging reuse and weak entries in one audit view. Work the results as a queue: email accounts first, then anything with money attached, then anything that can reset something else.
Why one leaked password endangers every account
Attackers rarely target you personally. They take a leaked list of email-and-password pairs and try them automatically against hundreds of unrelated services. This is credential stuffing, and it works because people reuse passwords. Your old shopping password is worthless in itself; it is valuable because the same string may well open your email or your work login. So the real question is never "was this account important?" but "where else did I use this?"
What to do, in order
- Change the password on the breached account first, using a new passphrase you have never used anywhere.
- Change it on every other account where you reused the same password or a close variant, most important first.
- Turn on two-factor authentication wherever it is offered, and switch to passkeys on services that support them.
- Check the breached account for what an attacker may have left behind: unfamiliar recovery addresses or phone numbers, mailbox forwarding rules and filters, app passwords, connected apps and API tokens.
- Sign out all other sessions and revoke devices you do not recognise.
Step four is the one people skip, and the one that leaves the door open: changing a password does nothing if the attacker already added a recovery address of their own, or a rule that quietly forwards your mail to them.
Two-factor authentication and passkeys
A second factor means a stolen password on its own is not enough to sign in. An authenticator app generating time-based codes is a solid default and beats SMS, which can be moved to another device through your mobile operator. To generate those codes, the free 2FA authenticator from 1mail handles standard TOTP setup in the browser.
Passkeys go further by removing the shared secret: the private key stays on your device, so the service's database holds nothing for a breach to expose. Where they are offered they are the better option, and our explainer on what a passkey is and how it replaces a password covers the trade-offs.
Why "changing one character" fails
Turning Summer2023 into Summer2024 feels like a new password and is not one. Attack tooling applies exactly these mutations by default: incrementing numbers, swapping letters for lookalike symbols, appending punctuation, capitalising the first letter. If your old password is in a leaked list, every predictable variant is effectively in it too. The replacement has to be unrelated and unique to that account. That is the argument for a password manager: you remember one passphrase, it remembers the rest.
Length beats complexity
Short passwords stuffed with symbols are hard for humans and easy for machines. Four or five unrelated words are the opposite: memorable to you, and long enough that brute force stops being practical. The words have to be genuinely random, though — a phrase that means something to you is weaker than it looks, so let a generator pick them. The 1mail passphrase generator produces random multi-word passphrases in the browser, and if you want the reasoning first, we go through it in our guide to building a strong passphrase you can actually remember.
How to stop it mattering next time
You cannot prevent a company from being breached. You can make each breach a five-minute inconvenience instead of a bad week: store a unique passphrase per account in a manager, generate each one with the passphrase tool rather than inventing it, enable a second factor on everything that matters, and review your recovery options once a year.
You can also reduce how many databases hold your real address. For a one-off download or a trial you are only testing, a throwaway address from the 1mail temporary inbox keeps that signup out of your permanent identity, and out of the next leaked list. Save your real address for accounts you intend to keep.
Frequently asked questions
Is it safe to type my password into a breach-check site?
Only if it uses k-anonymity, meaning the comparison happens in your browser and only a partial hash is ever sent. Prefer the checker built into your browser or password manager. Any site that wants the full password in a form is not worth the risk.
My password showed up in a breach but nothing has happened. Do I still need to change it?
Yes. Leaked lists circulate for years and get retried long after the original breach, so a quiet month means little. Changing it takes a minute; discovering the reuse after a takeover takes far longer.
Does a password manager become a single point of failure?
In theory, which is why its master passphrase should be long, unique and backed by a second factor. In practice the alternative — reusing a few passwords across dozens of sites — fails more often and more quietly. Concentrating the risk somewhere you can defend it is the better trade.
