How to Check if Your Email Address Is in a Data Breach

Quick check: go to haveibeenpwned.com, enter your email address, and read the data types listed for each breach. A match means your email was breached as part of a leak from another service, not that your inbox was accessed. If any breach lists passwords, change that password everywhere you reused it, then turn on two-factor authentication.

The check itself takes under a minute. The harder part is reading the result and acting in the right order. A breached address explains a lot of new spam, but a leaked password you reuse is the real emergency, and it comes before anything you do in your inbox. This guide covers the check, what your breach history means, the free alternatives, how to check several addresses or a whole domain, and what to do first.

Has my email been breached? What the result means#

A breach result means your address appeared in a leak from another service, not that your inbox was accessed. A breach database records that a dataset containing your email address escaped from a third party: a retailer, a forum, a game, a loyalty programme. It does not mean your email provider was compromised or that someone is using your account. What decides your next move is the other data that leaked alongside your address.

An email-only breach means your address is in circulation. Expect more spam, more phishing and more cold outreach, because your address is now on lists that get traded between bulk senders. That is a nuisance, not an account security problem. A breach that also included passwords is different: if you used that password anywhere else, and especially on your email account, change it now.

So the question is less “is my email breached?” and more “what leaked with it, and did I reuse that password?” The rest of this guide is built around that.

How to check if your email address is in a data breach#

An email breach check needs only your address and a browser. Here is the free check with Have I Been Pwned, and how to read your breach history once it loads.

1. 1

   Open Have I Been Pwned

   Go to haveibeenpwned.com. It is a free public breach search created and run by security researcher Troy Hunt since 2013. No account or payment is needed to check a single address, and its FAQ states that searches are not logged.

2. 2

   Enter your email address, not a password

   Type the address into the search field and press Enter. You will see either a message that no breaches were found, or a list of every indexed breach the address appeared in. The public search checks one address at a time.

3. 3

   Read your breach history

   For each entry in the breach history, note the service, the date of the breach, and the data types (the site labels them compromised data). Common types are email address, password, name, phone number, IP address and physical address. An email-only entry is low urgency. An entry that lists passwords is not.

4. 4

   Change the password on any breached site, and anywhere you reused it

   For each breach that listed passwords, change that password on that site and on every other account where you used the same one. Use a password manager to generate a long, unique password per site. If the reused password was also your email password, change your email password first.

5. 5

   Turn on two-factor authentication on your email account

   With two-factor authentication, a stolen password alone is not enough to sign in. Start with your email account, because password resets for everything else go through it. An authenticator app, security key or passkey is stronger than SMS codes where your provider offers them.

6. 6

   Check your other addresses

   Repeat the check for every address you own or have used: old work and university addresses, aliases and accounts you stopped using. Older addresses often show a longer breach history and may share a password you still rely on.

Other free breach checkers#

Have I Been Pwned is the best-known breach search, but it is not the only free option. These are the main alternatives as of October 2026. Google’s separate dark web report is no longer one of them: Google stopped scanning for new results on January 15, 2026 and retired the report on February 16, 2026, and now points people to Security Checkup and Password Checkup instead.

Checking several addresses or a whole domain#

There is no free way to paste a list into the public Have I Been Pwned search: it returns results for one address at a time, so for a handful of personal addresses, run each one separately. Then sign each address up for Have I Been Pwned’s free breach notifications. The verification email goes to the monitored address itself, so you can only monitor addresses you can open.

If you own a domain, such as a small business domain, Have I Been Pwned’s domain search shows breached addresses across the whole domain, but only after you prove you control it. Its FAQ notes that larger domains normally need a paid subscription to see the results. XposedOrNot offers free domain monitoring after you verify ownership through DNS, email or a file on your site.

A true bulk email breach check, run programmatically across many addresses, goes through the Have I Been Pwned API, and searching by email address there requires a paid subscription key. Beyond that, paid email breach monitoring is sold as part of identity-protection and security suites. If you are weighing one, compare what it adds over the free alerts above, such as identity restoration help or monitoring beyond email addresses, and check the vendor’s current price yourself.

What should you do after a breach, by email provider?#

The steps above apply whatever email service you use. The settings pages for changing your password, turning on two-factor authentication and reviewing sign-ins differ by provider. Menu labels change between versions, so if one does not match, search the provider’s help centre for the setting name.

What if the check comes back clean but the spam keeps arriving?#

Have I Been Pwned only indexes breaches that have been reported and loaded into its database. A recent breach may not be there yet, and data that only circulated privately may never appear. A clean result rules out a known, indexed breach. It does not rule out exposure.

If the result is clean and spam keeps rising, the usual explanations are a data broker selling your address, scraping from a public page or directory, or co-registration when a site shared its sign-up list with partners. Those are inbox problems rather than account problems, and our guide to how spammers got your address walks through each route. Whatever your result, sign up for the free breach alerts so you hear about future incidents without re-running the check.

Breached and hacked are not the same thing. A breach means another service leaked data that includes your address. Hacked means someone actually got into your email account: sent mail you did not write, changed your recovery details, or set up forwarding rules you did not create. If you see signs like those, the breach check is not the right tool. Follow our steps for what to do if your account was actually hacked, and if it is a Google account, review devices signed in to your Google account.

Managing the inbox fallout#

After a breach, the spam increase can last for years, because addresses get traded and re-traded between bulk senders. AI Emaily is not a breach monitor. It does not check breach databases, remove your address from leaked data, or replace changing your passwords and turning on two-factor authentication. What it does is the inbox side: it scores incoming mail for spam and phishing signals, routes cold outreach away from your main inbox and sorts newsletters, so real correspondence stays visible. If a breach has flooded your inbox and you have already handled the password steps, you can try it with a 7-day free trial at app.aiemaily.com.