How to Check If Your Password Was Leaked (Google, Apple)

Data breaches are routine, and the first sign is usually silence: your old password sits in a leaked database and nobody tells you. You can check in a few minutes using tools you already have. This guide covers Google, Apple and the free Have I Been Pwned service, then explains what to do about a hit.

Option 1: Google Password Checkup

Password Checkup scans the passwords saved in your Google Account and sorts problems into three groups: compromised (found published online), reused, and weak.

• Any browser: go to passwords.google.com, select Go to Password Checkup, then Check passwords. You may need to sign in.
• Chrome on a computer: open the More menu, then Passwords and autofill, Google Password Manager, and Checkup.
• Android: open Chrome, tap More, then Settings, Autofill and passwords, Google Password Manager, and Checkup.

Open each flagged item and change the password on that site, then save the new one. If a warning does not apply (an old account you already closed, for example), you can hide it with More and Dismiss warning.

Google can also alert you when a saved password shows up in a breach. To turn those alerts on or off, go to passwords.google.com, open Settings at the top right, and use Password alerts.

Option 2: iPhone, iPad and Mac

Apple checks your saved passwords against known leaks in a way that does not send the passwords themselves to Apple.

On iPhone or iPad (iOS 18, iPadOS 18 or later):

1. Open the Passwords app and tap Security.
2. Tap an account to see why it is flagged.
3. Tap Change Password to open the site and set a new one. If the site offers to upgrade you to a passkey or Sign in with Apple, take it.

To hide a warning you have dealt with, tap the account in Security, then Hide. The check runs on its own as long as Settings, Apps, Passwords, Detect Compromised Passwords is on.

On a Mac (macOS Sequoia or later): open the Passwords app, click Security in the sidebar, click an account, then Change Password. The toggle is under Passwords, Settings, Detect Compromised Passwords.

On iOS 17 and earlier: go to Settings, Passwords, Security Recommendations. Items are labelled Reused, Weak or Leaked.

Option 3: Have I Been Pwned (any email, any device)

Have I Been Pwned tracks breaches by email address, so it works even if you never saved a password anywhere.

1. Go to haveibeenpwned.com and enter your email address to see which known breaches include it.
2. For ongoing alerts, open haveibeenpwned.com/NotifyMe and enter the address.
3. Click the verification link sent to your inbox. From then on, you are notified when the address appears in a new breach. The service is free.

Check every email address you have used, including old ones.

What to do when something is flagged

Use a unique password for every account from a password manager. Where a site supports it, switch to a passkey, which cannot leak in a breach. We cover that in how to set up passkeys. For wider hygiene, see open source privacy tools.

How to spot a breach scam

Some "your password was leaked" emails are phishing. Do not click links in them. Go to the site or your password manager directly instead. Google's own advice is the same: if you get a leaked-password notice, open Password Checkup yourself to confirm it is real.

FAQs

Does a leaked email mean I was hacked?

No. It means the address was in a breach. The risk depends on what else leaked, mainly whether a password was included and whether you reused it.

Is Have I Been Pwned safe to use?

It is a long-running breach-notification service. Signing up is free, the site says it will never share your email address, and it verifies the address by email before sending alerts.

Does Apple see my passwords when it checks them?

No. Apple's platform security guide says the check compares a blinded fragment of a hash of each password against its leak list, so your actual passwords are not sent to Apple.

How often should I check?

Leave the automatic options on (Apple's Detect Compromised Passwords, Google's password alerts, Have I Been Pwned notifications) and run Google's Password Checkup every few months.

Are the checks the same on Android?

Android uses Google Password Manager, so the Google steps above apply. Menu labels can vary slightly by phone maker and Chrome version.