Have I Been Pwned

Almost every week, a database of email addresses and passwords leaks somewhere. Is yours in there? On Have I Been Pwned you check for free whether your email address appears in a known data breach. This article shows how it works and what to do if you're in one.

Check your email address

  1. Go to haveibeenpwned.com.
  2. Type your email address and select Check.
  3. Green means: not found. Red shows which breaches include your address, when they happened and which data was involved (passwords, phone numbers, addresses).
Checking an email address on Have I Been Pwned

Get notified of new breaches

Select Notify me and confirm your address. You get an email when your address appears in a new breach. Admins can monitor all addresses on their domain with domain searches.

Check passwords

With Pwned Passwords you check whether a password has ever leaked, without sending the full password. Microsoft Edge also warns you with Password Monitor when a saved password has leaked. Read save passwords in Edge.

You're in a breach: what now?

  1. Change the password for the breached service, and for any other site where you used the same password.
  2. Turn on two-step verification, or better: use passkeys where you can.
  3. Use a password manager so every account has a unique password.
  4. Be extra alert for phishing: criminals use leaked data to send convincing emails.
  5. Check where your account was signed in.

Work account leaked?

If your work address is listed, tell your IT department. With MFA and Entra ID Protection, a leaked password alone usually isn't enough to get in.

Nederlandstalige versie: Have I Been Pwned: controleer of je e-mailadres in een datalek zit

share on LinkedIn ☕ buy me a coffee

Related articles

▸Change or reset your password in Microsoft 365Change your password in My Account, reset a forgotten password yourself or reset a user's password as an… ▸Check where and when your Microsoft account was signed inReview your recent sign-ins with location and device in Microsoft 365 or your Microsoft account, and what to… ▸Detect risky sign-ins and users with Microsoft Entra ID ProtectionReview risky sign-ins, risky users and risk detections in Entra ID Protection, and respond automatically with… ▸How to set the password expiration policy in Microsoft 365Set whether passwords expire in Microsoft 365 (14 to 730 days), why Microsoft recommends never expiring, what… ▸The three most important reasons to enable MFAStolen passwords, one account that opens everything and demands from customers and regulators: three reasons…