To check if your email was in a data breach, enter it at an established independent service such as Have I Been Pwned or the Hasso Plattner Institute's Identity Leak Checker. They match the address against breaches that have become public. A hit means you should change that site's password and every password you reused elsewhere.
If you’ve had the same email address for more than a few years, it is almost certainly in at least one data breach. That’s not scaremongering. Breaches of platforms with tens or hundreds of millions of accounts have been a regular occurrence since the early 2010s. The useful question isn’t whether you’re in one, but which data leaked and where.
How breach checking works
When data from a breach turns up online, on a forum, a paste site or a file-sharing platform, security researchers collect it. Breach notification services load the email addresses into a searchable database, usually without the passwords. When you enter your address, the service simply looks up which known breaches contain it.
Two limits follow from that. No service knows about every breach, only the ones that have surfaced. And a hit tells you nothing about whether anyone has actually got into your account. It only says that data about you is out there.
Services to check if your email was in a data breach
| Service | Run by | How you get results | Notes |
|---|---|---|---|
| Have I Been Pwned | Troy Hunt (independent project) | in the browser | names each breach; free alerts for your address |
| Identity Leak Checker | Hasso Plattner Institute, Germany | by email to the checked address | only the address owner sees results |
| Mozilla Monitor | Mozilla | with a Mozilla account | uses Have I Been Pwned’s breach data |
| Built-in password checks | Google, Apple, Bitwarden, 1Password and others | inside the app | checks your saved passwords |
For the record: haveibeenhacked.de is an independent guide and has no connection to Have I Been Pwned. We don’t run a breach check and don’t collect addresses.
The HPI service has one quiet advantage: results go to the address that was checked, so nobody can look up which breaches a colleague’s address appears in. Have I Been Pwned shows results immediately, but hides hits from breaches it classes as sensitive until you verify you own the address.
Checking passwords without giving them away
Never type a password into a website to see whether it has leaked. Have I Been Pwned offers an API built on k-anonymity: you send only the first five characters of the password’s SHA-1 hash and get back every hash suffix in that range. The matching happens on your machine.
$ printf '%s' 'password' | shasum -a 1
5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 -
$ curl -s https://api.pwnedpasswords.com/range/5BAA6 | grep -i 1E4C9B93F3F0682250B6CF8331B7EE68FD8
1E4C9B93F3F0682250B6CF8331B7EE68FD8:52372427The number after the colon is how many times that password has appeared in breaches: more than 52 million for “password” as of October 2026. The response contains nearly 2,000 lines, so the server can’t tell which one you cared about. One caveat: the command above leaves the plain-text password in your shell history. For real passwords, use the breach check in your password manager, which uses the same method.
Spotting dodgy breach checkers
Fear of data breaches sells, and not everyone offering a “free scan” means well. Close the tab if a site:
- asks for your password as well as your address
- always returns an alarming result, with a paid subscription as the cure
- has no named operator or contact details
- wants you to install an extension or app to see the results
- talks vaguely about “found on the dark web” without naming a breach
Typing your address into a sketchy checker mostly means more marketing email. Typing a password into one can cause the exact damage it claims to warn you about.
What a hit actually means
Not every hit is equally serious. Look at which data fields the breach contained:
| Exposed data | Risk | What to do |
|---|---|---|
| Email address only | more spam and phishing | stay alert, little else |
| Email + password hash | account takeover if the hash is weak | change the password everywhere it was used |
| Email + plain-text password | urgent | change it now, enable 2FA |
| Phone number, postal address | targeted scam calls, SIM swap | set a carrier account PIN |
| Payment card data | fraud | contact your bank, cancel the card |
The step-by-step plan for a hit is in email in data breach: what to do.
Your own domain makes leaks traceable
A breach service tells you your address is out there. It doesn’t always tell you who passed it on. With your own domain you can find out yourself: give every service its own address, such as [email protected] or [email protected]. When spam arrives at utilities@, you know exactly where it came from. The setup is explained in catch-all email address.
Free webmail can only partly do this. Plus addressing like [email protected] works, but spammers and data brokers routinely strip the +shop part.
Checking once isn’t enough
New breaches are added all the time, often years after the original intrusion. Have I Been Pwned offers free notifications for individual addresses, and domain owners can monitor every address on their domain after proving ownership via a DNS record or email. If you run your own domain, that is the least effort option.
To limit the damage from the next breach, the single best habit is a unique password for every account, which in practice means a password manager, or better still passkeys, which can’t be stolen from a server in usable form.
If you don’t have your own domain for email yet, a .com at betadomain is €14.99 a year, with the same price on renewal. The domain search shows whether your name is free, and the full price list covers every other extension.
Step by step
- Look up your addressEnter your email at Have I Been Pwned or the HPI Identity Leak Checker. HPI sends the result by email to the address you checked.
- Note what each breach exposedFor every hit, record the service, the date and which data was exposed: email only, password hashes, phone number, postal address.
- Check passwords without revealing themUse your password manager's breach check or the Pwned Passwords range API, which only sends the first five characters of a SHA-1 hash.
- Secure the affected accountsChange the password on the breached service and anywhere you used the same one, then turn on two-factor sign-in or a passkey.
- Subscribe to alertsSign up for breach notifications so you hear about future leaks involving your address automatically.
Found your domain? You can check and register it directly at domains at a fixed yearly price – yearly price from €2.99.
FAQ
Is it safe to type my email into a breach checker?
With established services like Have I Been Pwned or the HPI Identity Leak Checker, yes; your email address isn't a secret. Be wary of unknown sites that also ask for your password. You should never type a password into a web form to check it.
No results. Does that mean I'm safe?
Not necessarily. Breach services only know about leaks that have surfaced publicly and been loaded into their database. Many breaches come to light years later, and some never do.
Why does my address show up for a site I never used?
Your address may have been shared with a partner or data broker, or someone signed up with it. Some breach collections are also recompiled lists from older leaks. Using a separate address per service on your own domain makes the source traceable.
Does a company have to tell me about a breach?
Under GDPR Article 34, controllers in the EU and UK must notify affected people when a breach poses a high risk to them, and the regulator usually within 72 hours under Article 33. In the US, notification duties come from state laws and vary. Plenty of people still learn about breaches from the news first.