Data breaches expose over 15 billion records annually, and most people find out months or years after their credentials were compromised. Free breach checking tools scan your email against known breach databases in under a minute. Each tool, what a positive result means, and what to do after finding your email in a breach.
HaveIBeenPwned: The Authoritative Free Option
HaveIBeenPwned (haveibeenpwned.com) was created by Troy Hunt, a Microsoft Regional Director and security researcher who has been aggregating breach data since 2013. As of mid-2026, the database contains over 14 billion breached records from more than 700 data breaches.
To use it: enter your email address, click "pwned?", and the service checks your email against every breach in its database. Results appear instantly with the name of each service that was breached, the date of the breach, and which data types were exposed (passwords, phone numbers, physical addresses, and others vary by breach).
HIBP also offers a password checker. Enter any password and it tells you how many times that exact password appears in known breach databases — without sending your password to any server (it uses k-anonymity hashing). If your password appears even once, consider it burned and replace it everywhere you used it.
Free email monitoring is available: register your email and HIBP notifies you at that address whenever it appears in a new breach. You can also set up free breach alerts to get automated notifications across multiple email addresses.
Firefox Monitor / Mozilla Monitor: Same Data, Different Interface
Mozilla Monitor (formerly Firefox Monitor) pulls breach data from the HaveIBeenPwned API. The underlying database is identical to HIBP. The value-add is the presentation layer: Monitor formats results with guided resolution steps and integrates with Firefox browser accounts for automatic monitoring.
Mozilla Monitor Plus (paid tier) adds additional data broker scanning — services that collect and sell personal information like home addresses and phone numbers. The free tier is breach checking only, using the same HIBP data you can access directly at haveibeenpwned.com.
If you already check HIBP directly, Firefox Monitor adds no new breach data. It is useful for users who prefer a more guided interface or Firefox account integration.
DeHashed: More Data, Partial Free Access
DeHashed (dehashed.com) aggregates breach data including records that HIBP does not index — dark web dumps, forum posts, and breach compilations that HIBP has not processed. For security professionals and people wanting the most comprehensive coverage, DeHashed has a meaningfully larger database.
The limitation: free searches on DeHashed show that results exist but require a paid subscription to view the actual exposed data. Pricing starts at around $5 per day or $15 per month as of 2026. For most individuals checking their personal email, HIBP's free database covers the major breaches. DeHashed is most useful for investigating specific incidents or checking organizational domains comprehensively.
What to Do After Your Email Appears in a Breach
Finding your email in a breach requires action within the day, not the week. Follow these steps in order:
Step 1: Identify what was exposed. HIBP lists the specific data types from each breach — password, phone number, date of birth, and others. If a password was exposed, that is the highest priority. If only your email and name were exposed (common in marketing database breaches), the risk is lower but still warrants checking.
Step 2: Change the password you used on the breached service. Go to that specific service and change your password immediately. Use a generated password of 16+ characters. Do not reuse any password you have used before.
Step 3: Check every other service using the same password. This is the critical step most people skip. If you used the same password on Gmail, your bank, and Amazon as you did on the breached service, change all three. A password manager shows you every site where a given password is reused. Bitwarden (free) and 1Password both flag reused passwords in their dashboards.
Step 4: Enable two-factor authentication on your email account. Your email is the master key to all other accounts — password resets go there. An attacker with your email password and no 2FA can lock you out of everything. Enable 2FA on your email provider first, then on any financial accounts.
Step 5: Watch for phishing attempts. Breached data is often used for targeted phishing. Attackers know your name, email, and potentially past passwords. Be suspicious of any message claiming to be from a service involved in the breach, especially if it requests login or payment.
What a Breach Result Does Not Mean
A breach result on HIBP does not mean your device was compromised. The breach occurred at the service's servers, not on your machine. Attackers obtained your stored credentials from the service's database — they did not access your computer.
It also does not mean your email account was accessed. Unless the breach involved your email provider specifically (like a Yahoo or AOL breach), finding your email in a breach for a different service means that service's records were taken, not your inbox.
The risk is the credential — attackers use breached passwords to try other services, not to remotely control your device. Change the password, check for reuse, add 2FA. That covers the actual threat.
Honest Caveat
No free breach checker has complete coverage. New breaches take time to appear in databases, and some breaches are never publicly disclosed or indexed. Finding no results on HIBP means your email is not in their current database — it does not guarantee your credentials have never been exposed. Treating every password as potentially compromised (by using unique generated passwords per site) eliminates the risk regardless of breach database coverage.
Frequently Asked Questions
What does it mean if my email appears in a data breach?
It means a service you used stored your email address (and possibly password, name, phone number, or other data) insecurely, and that data was obtained by attackers and later published or sold. Your email account itself was not necessarily accessed. The risk is that attackers use the breached password to try logging into other services you use — called credential stuffing. The immediate response: change the password you used on the breached service, and check if you reused that password anywhere else.
Does HaveIBeenPwned send my password to a server?
No. HIBP uses a technique called k-anonymity for password checks. You enter a password and the tool hashes it with SHA-1. It sends only the first 5 characters of that hash to the HIBP server. The server returns all hashes that start with those 5 characters. Your browser then checks locally whether your full hash appears in the list. Your actual password never leaves your device.
Is Firefox Monitor different from HaveIBeenPwned?
Firefox Monitor (now rebranded as Mozilla Monitor) uses the HaveIBeenPwned API for its breach data. The underlying database is identical. The difference is the interface — Firefox Monitor presents results in a more guided format with recommended next steps. If you check the same email on both services, you will see the same breach history.
My password was in a breach from 5 years ago. Do I need to do anything?
Only if you still use that password anywhere. If you changed it after the breach, and you do not reuse that password on other services, there is no immediate action required. If you are unsure whether you changed it, or if you recognize that password as one you still use, change it now. A password manager makes it easy to check which accounts use which passwords.
What is credential stuffing?
Credential stuffing is an automated attack where attackers take username-password pairs from one breach and try them against hundreds of other services. If you used the same password on the breached site as on your bank, email, or Amazon account, attackers try those credentials automatically using bots. This is why password reuse across sites is the single most dangerous password habit — one breach compromises every site where you used the same password.