Am I hacked? How to check your email, passwords and accounts

You can check in about 20 minutes, for free. First, look for signs that someone is using your accounts. Then search your email address on Have I Been Pwned and run the password checkup in your browser or phone. Appearing in a data breach is not the same as being hacked: it means a company’s data was exposed, so you change that password and move on.

Two different questions

“Was my data exposed?” and “Is someone using my account?” are not the same question.

• A data breach is when a company’s data is exposed or stolen. Your email address or password may be part of it, even if nobody ever touched your own account.
• An account takeover is when someone signs in to your account as you.

A breach can lead to a takeover, especially if you reuse passwords. That is why you check both, in this order.

Step 1: Look for signs of a takeover

The FTC’s guide to hacked accounts (page dated August 2023) lists these signs:

• You cannot sign in to your account.
• You get a notice that your username or password changed, and you did not change it.
• You get a notice of a sign-in from a device or place you do not recognize.
• Friends or family get emails or messages from you that you did not send, sometimes with “fake pleas for help or money.”

Your account’s own security page can confirm it. In a Google Account, open Security & sign-in and look at Recent security events. If you see activity you did not do, select “No, it wasn’t me” and follow the prompts. Google also says to check “Your devices” for any you do not recognize. On an iPhone, Apple’s device list is in Settings, under your name. It shows the devices signed in to your Apple Account.

If you see any of these signs, skip ahead to “If you find a problem.”

Step 2: Search your email address

Have I Been Pwned (HIBP) was created by Troy Hunt. Its About page calls it “a free resource for anyone to quickly assess if they may have been put at risk.” On October 27, 2026, its home page showed 1,047 “pwned websites” and 17,846,550,965 “pwned addresses.” “Pwned” is gamer slang for “owned,” or compromised.

1. Go to haveibeenpwned.com.
2. Type your email address and press the check button.
3. Read the result. It either says no breach was found, or it lists each breach and any “pastes.” A paste is information posted on a public text-sharing site, such as Pastebin, where your address appeared.

Check every email address you have used. For each breach, look at the data that was exposed. HIBP’s records list the types of data in each breach, such as email addresses or passwords. A breach that exposed only your email address is much less serious than one that exposed passwords.

HIBP’s FAQ says searches are not logged. Its Notify Me option sends an alert to the address you monitor when it appears in a future breach. The FAQ also says some breaches are marked sensitive and appear only after you verify, by email, that the address is yours.

A clean result does not prove you were never exposed. HIBP lists only the breaches it has loaded.

An old breach cannot be undone. HIBP’s FAQ calls a listing “an immutable historic fact; it cannot later be changed.” Your address will stay on the list. What matters is whether you still use the password you had then, and whether you reused it elsewhere.

Step 3: Check your passwords

Your browser or phone can check the passwords you have saved. Start there.

• Google: In Chrome, open the More menu, then Passwords and autofill, then Google Password Manager, then Checkup. In other browsers, go to passwords.google.com and choose Password Checkup. Google says to “change any compromised passwords as soon as you can,” and warns that reusing a password across accounts raises your risk of being hacked.
• iPhone: Open the Passwords app and tap Security. Apple says your iPhone flags passwords that are easy to guess or used more than once. It can also alert you if a password appears in known data leaks. To turn that on, go to Settings, Apps, Passwords, then turn on Detect Compromised Passwords.

You can also try a single password at HIBP’s Pwned Passwords. It is free, and it uses a method called k-anonymity. The page says it works “without ever sending the full password or its complete hash to the service.” A hash is a scrambled version of a password. If a password you use appears there, change it everywhere you have used it.

If you find a problem

Take these steps in order. Start with your email account, because it can reset your other passwords.

1. Change the password. Pick a long one. The FTC says to aim for at least 12 characters. Our password generator can make one. Then change the same or a similar password on every other site. The FTC says this applies after a company reports a breach of your password.
2. Turn on a second step. Two-factor authentication asks for a second proof that it is you. The FTC says text and email codes are “the least secure type,” and that an authenticator app or security key gives more protection. A passkey is another option. Google says passkeys “can’t be shared, copied, written down, or accidentally given to someone else,” which makes them “more secure against phishing.” See Passkeys vs passwords.
3. Sign out of everything else. The FTC says signing out of all devices kicks out anyone who is logged in elsewhere. In a Google Account, go to Security & sign-in, then Manage all devices. On an iPhone, open Settings, tap your name, and use Remove from Account on devices you do not know.
4. Check recovery details. The FTC says to make sure the recovery email addresses and phone numbers are ones you entered and still control.
5. Look for forwarding rules. A hacker can set your email to copy messages to another address. The FTC says to check for forwarding rules you did not set up. In Gmail, go to Settings, See all settings, then Forwarding and POP/IMAP. Google says filters can forward mail too, so check your filters as well.
6. Review sent and deleted mail. Look for messages the hacker sent or read and deleted. Tell your contacts about the hack, and warn them not to click links from you or send money.

If you cannot sign in at all, use the provider’s account recovery page. The FTC links these for Facebook, Google, Instagram, Microsoft, Yahoo, and X.

When your identity or money may be at risk

If someone has used your Social Security number, the FTC says to report it at IdentityTheft.gov and get a recovery plan. If you are not sure, it points you to IdentityTheft.gov/databreach. If someone may have used your financial information, Google advises you to contact your bank.

A credit freeze is a strong, free step. The FTC says that while a freeze is in place, nobody can open a new credit account in your name, and that it is free to place or lift. Learn how in How to freeze your credit.

Check your devices too

If your accounts look fine but your phone acts strangely, read How to tell if your phone is hacked. For a Windows or Mac computer, see Do you need antivirus?

What can go wrong

• Changing the password does not remove a forwarding rule or a hacker’s recovery email. Check both.
• A text-message code is better than nothing, but it is the weakest second step, according to the FTC.
• Do not trust a stranger who offers to recover a hacked account or lost money. The FBI warned on July 20, 2026 that scammers pose as the FBI’s Internet Crime Complaint Center. It says the center “will never ask for payment to recover lost funds.”
• Never type a password into a site you reached from a message. Open the site yourself.

What to do now

1. Search your main email address at haveibeenpwned.com, and use Notify Me to hear about future breaches.
2. Run your browser or phone password checkup, and change every compromised or reused password, starting with email and banking.
3. Turn on two-factor authentication, or a passkey, for your email account first.
4. Review the devices and forwarding rules on your email account, and sign out anything you do not know.
5. If your Social Security number may be exposed, freeze your credit.