Tool
Have I Been Pwned
Price
Free for basic use
Time
2 to 10 min
Level
Beginner, nothing to install

A data breach is when the customer database of a website (a shop, a social network, a piece of software) gets exposed. Your email address, and sometimes a password, then end up in the wrong hands. The risk for a small business: someone tries that password again on your work inbox, your bank or your CRM.

Check an address

  1. Open the official websiteGo to haveibeenpwned.com by typing the address yourself. Be wary of lookalike sites sent by email or shown in ads.
  2. Enter your email addressType your work address, then click “Check”. The site either says no breach is known, or lists the breaches it appears in, with the date and the kind of data exposed (email, password, phone number…).
  3. Repeat for each addressYour personal address, contact@, your billing address, the one you use to log in to your tools. Write down the breaches found and the websites involved.

If your address shows up

  1. Change the password on that websiteAnd above all on every site where you used the same one. A different password for each site, kept in a password manager, fixes the root of the problem.
  2. Turn on two-factor authenticationA code or a passkey on top of the password, on your inbox first: that is the account that can reset everything else.
  3. Check a specific passwordThe Pwned Passwords page tells you if a password has already leaked. According to the site, the full password is never sent: only a small piece of its scrambled fingerprint (its hash) goes out, and the comparison happens in your browser. If it shows up, stop using it everywhere.

Get warned about the next breach

  1. Sign up for alertsThe Notify me page emails you if the address appears in a future breach. The alert only goes to the monitored address: you cannot monitor someone else's.
  2. Monitor your whole domainIf you have your own domain ([email protected]), domain search lists every address on your team that was hit. You first have to prove the domain is yours. According to the pricing page as of 17 October 2026, it is free as long as the domain has 10 or fewer breached addresses.

Good to know

  • “No breach found” means no breach known to the site, not zero risk.
  • Changing your password does not remove the address from the list: the breach is a past event and the site keeps showing it.
  • A breach containing your email makes phishing attempts more convincing: be extra careful with messages that mention that service.

Ground rules. Only check your own addresses or your company's. An email or text saying “your data has leaked, click here” is often a scam itself: always go through the official website, typed by hand.

Sources

Want these alerts to land in your team tool, with the list of accounts to secure? That is the kind of automation I set up.