How to Check If Your Data Was Leaked (HaveIBeenPwned Tutorial)

In 2025 alone, over 4.5 billion records were exposed in confirmed data breaches. That's more than half the world's population. The uncomfortable truth is that some of your personal data — email addresses, passwords, phone numbers, maybe even credit card information — has almost certainly appeared in a breach you never heard about.

The question isn't whether you've been breached. It's which breach exposed your data, and what you do about it.

HaveIBeenPwned (HIBP) is the definitive resource for checking whether your information has been caught in a data breach. Created and maintained by security researcher Troy Hunt, it's used by millions of people and contains records from over 600 confirmed data breaches. Here's how to use it effectively.

What Is HaveIBeenPwned?

HaveIBeenPwned aggregates data from public breach disclosures, security researcher disclosures, and submissions from companies that have been breached. It allows anyone to search by email address, phone number, or password to see if their data appears in any known breach.

The site doesn't just say "you were breached" — it shows you:

• Which specific breaches exposed your data
• What types of data were exposed (email, passwords, personal info, etc.)
• When the breach occurred and was disclosed
• What the breach looked like before the data was taken

Most importantly, HIBP is read-only for most users — you're not creating an account or handing over more data to check your existing data.

Method 1: Check by Email Address

The email check reveals breaches where your email address appeared. This matters because:

• Your email is often the username — knowing it allows credential stuffing attacks
• Breached emails get sold on dark web markets — they become targets for phishing
• It indicates what password patterns you used — if LinkedIn was breached and your work email was exposed, attackers know you probably used the same password elsewhere

Understanding Breach Classes

Each breach on HIBP is tagged with a "class" that indicates what happened:

Method 2: Check by Phone Number

Phone number checking works similarly to email — you enter your number in international format (+1XXXXXXXXXX for US), and HIBP shows breaches where that phone number appeared. This is useful because many breaches in recent years have exposed phone numbers alongside other personal data.

How to Check by Phone:

1. Go to haveibeenpwned.com
2. Click the "Phone" tab
3. Enter your number in international format
4. SMS verification required (this is to prevent abuse)
5. Review matching breaches

Method 3: Check Your Passwords

HIBP's Password Search lets you check if a specific password has appeared in any known breach. This is safe to do because:

1. The password is sent using k-Anonymity (only first 5 characters of the hash are transmitted)
2. HIBP's API returns only whether the password exists in breaches, not where
3. No one can see which account the password belongs to

How to Check a Password:

1. Go to haveibeenpwned.com/Passwords
2. Enter the password you want to check
3. The site will show how many times this exact password appears in breach databases
4. If count > 0: this password is compromised and must be changed EVERYWHERE it was used

curl -H "Add-Padding: true" https://api.pwnedpasswords.com/range/YOUR5CHARS

Method 4: Get Notifications (Don't Just Check Once)

HIBP offers free email notifications through the "Notify me" feature. Instead of manually checking periodically, you get an email when your address appears in a new confirmed breach.

You should set this up for every email address you use for important accounts. Yes, even that old Hotmail address from 2003.

What to Do When Your Data Is Found

Finding your data in a breach doesn't mean you're doomed. It means you need to take specific actions depending on what was exposed.

When Email Addresses Were Exposed

Risk: Phishing attacks, spam, credential stuffing

• Be extra vigilant about emails from unknown senders
• Don't click links in emails; navigate directly to sites instead
• Use email filtering and mark suspicious messages as spam
• Consider using email aliases (like 33mail or SimpleLogin) for future signups

When Passwords Were Exposed

Risk: Account takeover if you reused that password anywhere

1. Change the password on the breached service first — if attackers log in there, they may change your password and lock you out
2. Change passwords on any other accounts using the same or similar passwords
3. Use a password manager — this is when having unique passwords per account matters
4. Enable 2FA on the affected account — if you weren't already

When Personal Information Was Exposed

Risk: Identity theft, social engineering, account recovery fraud

• Monitor your credit reports — check for unfamiliar accounts or inquiries
• Consider a credit freeze — free in most states, prevents new accounts from being opened in your name
• Watch for account recovery attempts — attackers sometimes try to hijack accounts by claiming to have forgotten the password
• Be wary of social engineering — if attackers know your pet's name or birthday, they may use these to impersonate you

When Financial Data Was Exposed

Risk: Fraudulent charges, cloned cards

1. Contact your bank/card issuer immediately — cancel the exposed card and get a new one
2. Review recent transactions — dispute any unauthorized charges
3. Set up transaction alerts — many banks offer free push notifications for charges over a threshold
4. Consider temporary limits — some banks let you set daily spending caps as an extra precaution

The Breaches That Affect Most People

Some breaches are so large or so commonly used that they're worth checking specifically:

If you've never checked HIBP before, the odds of finding multiple matches for your email are very high. Don't be alarmed — use it as motivation to improve your security practices.

How to Make HIBP More Useful

1. Check your entire digital footprint

Search your email addresses, old email addresses, phone numbers, and even significant other's or family members' emails if they're in your care. Children are increasingly targets for identity theft because their clean credit profiles are valuable.

2. Use the Firefox Monitor integration

Firefox Monitor (monitor.firefox.com) is powered by HIBP and offers the same breach checking. If you use Firefox, you get automatic breach alerts baked into the browser. Mozilla has an excellent track record of protecting user privacy.

3. Integrate HIBP with your password manager

1Password, Bitwarden, and LastPass all offer optional HIBP integration that checks your saved passwords against breach databases. When you log into a site with a password that's appeared in a breach, you'll get a warning. Enable this feature — it's free.

The Bigger Picture: Assume You're Breached

Zero prevention is impossible. Your data has almost certainly touched at least one poorly secured database somewhere. The question isn't whether to react to that fact — it's whether you've put the defenses in place to make breached data useless to attackers.

Strong unique passwords for every account (via a password manager) eliminate the most common attack vector. 2FA on critical accounts means even a compromised password isn't enough. Credit freezes prevent financial identity theft. Monitoring services catch misuse early.

Quick Action Checklist

1. Go to haveibeenpwned.com right now and check your primary email
2. Check any other emails you use for important accounts
3. Sign up for breach notifications on all your email addresses
4. Run a password audit — use HIBP to check any passwords you're unsure about
5. Enable 2FA on email, banking, and password manager accounts
6. Review your credit — get free reports from annualcreditreport.com

The best time to find out you've been breached was years ago. The second best time is right now, before attackers use your compromised data against you.

HaveIBeenPwned won't protect you from breaches — nothing can do that completely. But it gives you the visibility to know when you've been exposed and the knowledge to respond appropriately. Check it regularly, set up notifications, and use what you learn to improve your security practices going forward.

Your data is likely out there somewhere. Whether that becomes a problem depends on what you've done to prepare.