Check for a leaked password without typing it in
Never type a real password into a website to check it. Search the email address or username you use it with, and each record found shows whether a password or its hash leaked.
- No password asked for
- Free, five checks a day
- Masked results
How to tell if a password leaked
Passwords don’t leak on their own: they leak inside an account record, beside the email address or username they belong to. So the way to find a leaked password is to search for the account.
Search an email address or username above. For each record in the sample, the result says whether a password, a password hash, or neither leaked with it. The values themselves are never shown.
If a password or hash leaked, assume it is known, and change it everywhere you have used it.
Passwords and hashes
A password
Stored as written, it can be used straight away, by anyone who has the breach data, on any site where you used it.
A password hash
A scrambled form of the password. Strong, unique passwords behind a modern hash hold up well; short or common ones are recovered from their hashes quickly. Treat a leaked hash as a leaked password.
Neither
The record holds the account but no password. It still tells attackers that the address or username is real, so expect phishing.
After a leaked password
A leaked password is only dangerous where it still works. These close that off.
Change it everywhere
On the breached site and every other site where you used the same password, starting with email, because email resets everything else.
One password per site
A password manager makes a unique password for each account and remembers it, so one leak can never open a second account.
Two-factor sign-in
With an authenticator app or a passkey, a leaked password alone is no longer enough to get in.
The full records are on Seer
This site shows how many breach records hold what you searched, and a masked sample of them. The check is run by Seer, which shows the full records: which breach each came from, when, and what leaked with it.
Seer also searches stealer logs, the records malware takes from infected devices, and finds the social accounts tied to an email address, username or phone number.
Try Seer’s free check- Breached credentialsEvery record an email address, username, phone number or domain appears in.
- Stealer logsLogins captured by malware on infected devices, searchable by email, username or domain.
- Social accountsAccounts on 740+ platforms by username, 106 by email address and 20 by phone number.
- Plans and pricingWhat a free account includes, and what the paid plans add.
Questions
Can I check if my password has been leaked?
Check the email address or username you use with it. Each record found shows whether a password or a password hash leaked with that account. Never type a real password into a website to check it.
What is the difference between a leaked password and a leaked hash?
A password leaked as written can be used straight away. A hash is a scrambled form of it, and weak or common passwords are recovered from their hashes quickly, so treat a leaked hash as a leaked password.
My password leaked years ago. Does it still matter?
Yes, if you still use it anywhere. Old breach data is collected into lists that are tried against other sites for years. Change it wherever it is still in use.
How do I stop one leak from opening my other accounts?
Use a different password for every site, kept in a password manager, and turn on two-factor sign-in, ideally with an authenticator app or a passkey.