Email breach checks: HIBP, false positives, next steps

The short version

A breach check tells you whether your email address has turned up in a company data leak. Seeing your address in a list is unsettling, but it's extremely common and usually not an emergency. It does not mean you were personally hacked. This guide explains what a result really means, how the trusted tool Have I Been Pwned works, which results are false alarms, and the short list of things actually worth doing.

What's actually happening

When a company you once signed up with gets hacked, the stolen list of accounts, often emails and passwords, gets traded and eventually collected into public databases. A breach-check service gathers those leaked lists and lets you ask, "is my address in any of them?"

Think of it like a lost-and-found for stolen data. Finding your email there means a company that held it was breached, not that your email account itself was broken into. The real risk is narrow and specific: if you reused the password from that breached site anywhere else, those other accounts are exposed.

Why it matters to you

• A leaked email plus a leaked password is the recipe for "credential stuffing," where criminals try that same combination on your bank, email, and shopping accounts.
• Even without a password, a leaked email means more targeted spam and phishing.
• Knowing which breaches you're in tells you exactly which passwords to change first.

What to do next

Don't panic, and don't buy anything or click links in any "your account was hacked" email. Work through this short list.

1. See what you're actually in

1. Go to the official haveibeenpwned.com and type your email into the big search box.
2. If nothing is found, you'll get a cheerful all-clear. If something is found, you'll see a list of the breaches, each with the date and what data was exposed (for example "email addresses and passwords," or just "email addresses").
3. Read the "compromised data" line for each. That tells you how serious it is.

2. Change reused passwords first

1. For any breach that exposed passwords, change your password on that site, and anywhere else you used the same password.
2. Make every password different. The only realistic way to do that is a password manager (your phone and browser have decent ones built in, like iCloud Keychain or Google Password Manager).

3. Turn on two-step login

1. Turn on two-factor authentication (2FA), also called two-step verification, for your most important accounts: email first, then banking and shopping.
2. An authenticator app or a physical security key is stronger than text-message codes. With 2FA on, a stolen password alone isn't enough to get in.

4. Check passwords, not just the email

1. Most password managers now flag saved passwords that are known to be leaked or reused. Open yours and fix anything it warns about.

As an Amazon Associate, WhoAmI earns from qualifying purchases.

Which results are false alarms

Not every entry is cause for action:

• "Email addresses only." If a breach exposed only your email (no password), there's little to do beyond expecting more spam. Your password is fine.
• Old breaches you already handled. If you've since changed that password and it's unique, you're covered, the record just stays in history.
• "Pastes" and giant combo-lists. Some entries come from huge recycled collections, not a fresh hack of a specific site. They're a reminder to use unique passwords, not a sign of a new break-in.

The genuinely concerning results are recent breaches that exposed passwords for accounts where you reused that password.

How to check it worked

After changing reused passwords and enabling 2FA, your exposure is largely neutralized even though your email stays in the breach history forever (that can't be erased). You can sign up for Have I Been Pwned's free notifications so you're emailed automatically if your address appears in a future breach, which is the real win: early warning next time.

If your result was already good

If your email wasn't found, or only appeared in "email only" breaches, that's a good result and there's nothing urgent to do. Keep it that way: use a unique password for every account (a password manager makes this painless), turn on 2FA for your email and money accounts, and consider signing up for free breach notifications so you hear about any future leak immediately. A clean result today doesn't prevent a future breach, but good habits make one harmless.

Want to go further?

The Advanced version covers how HIBP's k-anonymity password check works (your password is never sent), domain-wide monitoring, the API, why "dehashed" combo lists cause confusing results, and hardware security keys and passkeys as the strongest defense.

Summary

Breach checking answers whether an identifier (email, and separately a password) appears in known compromised datasets. Have I Been Pwned (HIBP) is the reference service: it aggregates breach corpora, lets you search an address, and exposes a privacy-preserving Pwned Passwords API using k-anonymity. The 2025 "HIBP 2.0" rebuild unified verified features behind a single email-verified dashboard. The correct response to a hit is credential hygiene (unique passwords, MFA/passkeys), scoped to breaches that actually exposed secrets.

What's actually happening

• Corpus aggregation. HIBP ingests breaches (and some "pastes") and indexes exposed email addresses plus a per-breach list of compromised data classes (emails, passwords, names, etc.). A hit means an address was present in that dataset, nothing about your mailbox being accessed.
• Email search. Client-side search against the index; the 2025 redesign added a unified dashboard (email-verified) housing sensitive breaches, domain search, API keys, subscriptions, and stealer-log data, and switched bot protection to Cloudflare Turnstile. Username and phone search were removed from the web UI (still in the API).
• Pwned Passwords (k-anonymity). You SHA-1 (or NTLM) the password locally, send only the first 5 hex chars of the hash; the API returns all suffixes in that bucket with counts; you match locally. The full password/hash never leaves your machine. A non-zero count means that exact password has appeared in breaches, retire it.
• Notifications & domains. Free "Notify me" emails you on future appearances; domain monitoring (verified) covers every address on a domain you control.

Why it matters

The operational threat from breaches is credential stuffing: automated replay of leaked email/password pairs across unrelated sites. Password reuse is what turns one company's breach into a compromise of your email, bank, or cloud. A leaked email alone chiefly raises phishing/spam exposure. Prioritization therefore hinges on the data classes per breach and on where you reused credentials, not on the raw count of appearances.

Triage and remediation, per step

1. Enumerate exposure. Search your addresses on HIBP; for each hit note date and compromised data classes. Treat password-bearing, recent breaches as priority.
2. Audit password reuse. Run your password manager's breach/reuse report (1Password Watchtower, Bitwarden reports, iCloud Keychain and Google Password Manager "compromised passwords" both use HIBP-style k-anonymity checks). Rotate every reused/weak/known-leaked secret to a unique, long, random value.
3. Add a second factor, prefer phishing-resistant. Enable MFA on email and financial accounts. Order of strength: passkeys / FIDO2 hardware security keys > TOTP authenticator app > SMS (SIM-swap-prone, last resort).
4. Adopt passkeys where offered. They replace the shared-secret password with device-bound public-key auth, immune to reuse and phishing.
5. Monitor forward. Enable HIBP notifications and, if you own a domain, verified domain monitoring.

False positives and confusing results

• Email-only breaches: no secret exposed; impact is phishing/spam. No password change required.
• Combo lists / "collections" (e.g., Collection #1, large stealer dumps): aggregated, recycled, often-stale credentials rather than a fresh single-site breach. Useful as a reuse warning, not proof of a new compromise; many entries may be old or never valid.
• Pastes: an address appearing in a paste may be scraped or list-sourced, not necessarily a breach of a service you used.
• Already-remediated breaches: the historical record persists; if the password was changed and is unique, there's no residual risk, you cannot delete the breach record.
• Pwned Passwords count > 0 on a password you still use: that's a true positive, change it even if the breach that introduced it is unknown.

How to verify

Confirm remediation by (1) re-checking rotated passwords against Pwned Passwords and expecting a count of 0, (2) verifying MFA is enforced (test a fresh login requires the second factor), and (3) confirming your password manager's reuse/compromise report is clean. For developers, you can exercise the k-anonymity API directly: request https://api.pwnedpasswords.com/range/<first5> and confirm your suffix is absent. Enabling notifications validates forward monitoring.

If your result was already good

No hits (or email-only hits) means no urgent action, but a clean check is a snapshot, not immunity. Maintain the posture that keeps future breaches harmless: unique per-site credentials via a manager, phishing-resistant MFA (passkeys/security keys) on high-value accounts, and HIBP notifications/domain monitoring for early warning. The record you can't change is historical presence; the thing you control is whether a leaked credential is reused anywhere.

Want to go further?

Move high-value accounts to passkeys and back them with FIDO2 hardware security keys (two keys: one primary, one backup stored safely) so a breached password is simply not a usable credential. Review account recovery paths (they're a common bypass of your MFA), lock down your email as the root of most resets, and if you run a domain, wire up HIBP domain monitoring and tighten your email authentication (SPF/DKIM/DMARC) to cut phishing that trades on your brand.