Tools

Type a password you use. Your browser scrambles it into a 40-character code (a SHA-1 hash). Only the first 5 characters are sent to Have I Been Pwned, which returns every leaked code starting with them. Your browser does the matching, so the password never leaves this device.

For this step we send you to Have I Been Pwned, and that's on purpose. Checking an email means sending the address itself, and we'd rather never see it. Have I Been Pwned is the most widely used breach database and has been running since 2013.

• Type your email in the search box on their home page. The free search is all you need.
• Skip the paid plans, sponsor ads and protection offers. You don't need any of them to finish this step.
• If breaches show up, change your password on those sites and anywhere you reused it, and turn on two-step login where it's offered.
• "No breaches found" is good news, but not a guarantee. Keep using a different password on every site.

For sites that take requests by email, or companies with no opt-out form. Fill in what you're comfortable sharing and get a ready-to-send draft. Nothing you type here is saved or sent anywhere; you send the email yourself.

Send it from the email address you want them to reply to. Don't add ID numbers such as a Social Security number; if a company needs to verify you, it can ask. These drafts are templates, not legal advice.