Frequently asked questions

When you sign up with a shop, a social network or an online bank, that company stores your details: your email address, sometimes your password, your phone number, your home address.

If that company's database is stolen, your details leave it and start circulating in lists that get passed from one stranger to the next. That is what being exposed means: information about you is out there without you knowing.

You did not cause it. The company you trusted with your details did.

Not you directly. Nobody got into your computer or your phone.

A company you once signed up with was robbed, and your details were inside that batch, along with those of millions of other people. It may have been eight years ago, on a site you no longer even remember.

Which is why it is not fixed by scanning your device or changing your antivirus. It is fixed by changing the passwords that were exposed, starting with the ones that open something that matters.

Because with your email address and a password, someone can try to get into your other accounts.

Almost everyone reuses passwords. If the one leaked from some random shop is the same one as your email or your bank, they already have the key. And they do not need to be experts: there are programs that try thousands of combinations on their own, overnight, with nobody watching.

There is a second, quieter risk. With your real details in hand, a scammer can write you a very convincing message: your name spelled correctly, your phone number, the name of a shop where you really did buy something. Far more people fall for that than for a generic email full of mistakes.

Almost never directly. If what leaked was the password to a forum or a game, there is no money in there.

The risk appears if you use that same password at your bank or on your email. Then yes, they have somewhere to start.

There is another route, and it is the more common one: somebody writes or calls pretending to be your bank, using your real details to sound credible, and you hand over the key yourself.

No. A breach does not give anyone control of your phone or your computer. These are two different things: here a company's list of data was stolen, nobody got into your device.

To switch on your camera, someone would have had to install a program inside your device. That does not happen because your address turns up in a list.

What they could read, if they have the right password, is your email, signing in with your own key as though they were you. That is why the first password to change is your email one.

The warnings from your browser or your phone saying that a password has leaked are real. Google, Apple and Firefox check the passwords you have saved against the same public lists we query here.

How to tell a real one from a scam: the real warning does not ask for money, does not ask you to install anything and does not rush you. It only tells you to change a password.

If the message puts a countdown clock in front of you, asks for a card or offers you a program to "clean up" your device, it is a scam. Close it and go to the site yourself by typing the address in by hand.

It means a company you once signed up with was robbed of its data, and your address was in the batch. It does not mean anyone has your current password or that your mailbox has been broken into. What matters is what leaked alongside your address.

Your address on its own getting out is annoying and little more. Your address together with a password is a different matter, especially if you reused that password somewhere else. That is why the result tells you what kind of data turned up in each case, not just how many times.

Three things, in this order:

1. Change your email password. It is the one that opens all the others, because that is where they get recovered.
2. Turn on two-step verification on that email. It is the lock that still works even if somebody has your password.
3. Change the password anywhere there is money: your bank, payment apps, shops with your card saved.

The rest can wait for the weekend. Those three, today. The full order is laid out in what to do if your email was leaked.

On that account, yes. The old password stops working the moment you change it.

But the leaked password stays in those lists forever, and that does not get erased. Which is why the new one must not resemble the old one, and must not be used anywhere else.

And if you had that same password on other accounts, those are still open. Changing one does not change the others.

No, and doing so usually backfires. Changing twenty passwords in one afternoon leads to picking twenty variations of the same one. Start with your email, move on to anything with money attached, and deal with any site where you reused a password.

The order matters more than the number, and it is laid out in what to do if your email was leaked.

You can look. Most big services keep a record of who signed in and from where. In Gmail it is at the bottom of the inbox, under "Last account activity". In WhatsApp, under Settings, "Linked devices". In Facebook and Instagram, inside Settings, in the security section.

Look for anything you do not recognise: a city you have never been to, a device that is not yours, a time when you were asleep. If you see one, end that session and change the password straight away.

Some signs arrive on their own: welcome emails from services you never signed up for, sent messages you did not write, or password reset notices you never asked for.

No. The address is used to run the lookup and then discarded. It is not written to any database, not added to any mailing list, and never travels inside the page address, which is the part that would end up in the server's access logs.

What is kept, briefly, is your IP address, for one purpose only: to stop anyone using the search box to work through thousands of other people's addresses automatically. We would rather say so than pretend it does not exist.

Your browser works out a fingerprint of the password and sends only the first five characters of it. The service returns every leaked fingerprint that starts the same way, usually several hundred, and the final comparison happens inside your browser. The password itself never leaves your device.

Put another way: whoever receives the query knows somebody asked about a group of passwords, but cannot tell which one. The technique is called k-anonymity, and there is a fuller explanation in how to know if your password was leaked.

From Have I Been Pwned, the public breach registry that security researcher Troy Hunt has maintained since 2013. It is the same source used by news outlets, companies and the warning your own browser shows when a saved password has been compromised. We do not collect breaches ourselves.

That registry gathers the data already circulating after each theft, verifies it and indexes it so anyone can check whether their address is in there. The data is used under its Creative Commons Attribution 4.0 licence, which requires naming the source, which is why you will see it credited here and under every result.

Not for the free check. An account is only needed if you buy the action plan, because the access has to belong to someone.

If you do create one, what we keep is your email address and an encrypted, irreversible version of your password, never the password itself.

A plan written for your specific result, ordered by what to deal with first, in plain language. You read it on the site and can download it as a PDF to print or keep. Access lasts 30 days, and you can come back and update it during that time.

US$ 5, charged in US dollars through Stripe. The price on the button before you pay is the price you are charged; any tax due is shown on that same screen.

It is a one-off payment, not a subscription: it gives you access for 30 days and renews nothing. Checking an email address or a password is free and asks for no card.

Yes. Write to us and we will remove it along with the purchase history attached to it. You do not have to explain why.